{
  "family": "opanki",
  "sample_count": 9,
  "category": "backdoor",
  "description": "Worm:Win32/Opanki is a legacy, self-propagating worm that gained extreme prevalence in the mid-to-late 2000s by aggressively exploiting Instant Messaging (IM) networks—specifically AOL Instant Messenger (AIM) and MSN Messenger. Its primary objective was rapid, viral propagation across social networks, turning infected endpoints into localized spam bots that bombarded the user's contact list with malicious links.<br><br><b>Understanding the Opanki Worm</b><br>To an infected user, the computer might seem fine, but their friends would suddenly report receiving strange, out-of-character messages from them containing suspicious links (e.g., 'haha look at this picture of us!'). For security analysts, Opanki was a nightmare of lateral movement via social engineering, utilizing the trust inherent in IM contact lists to achieve massive infection rates.<br><br><b>Propagation and IM Hijacking Mechanics</b><br>The infection cycle begins when a victim clicks a malicious link received from an infected friend via an IM client (`T1566.001`). The link downloads the Opanki executable (often disguised as a `.scr` screensaver or a `.pif` file). Upon execution (`T1204.002`), it establishes persistence via Registry Run keys (`T1547.001`). The worm then hooks into the active APIs of the running Instant Messaging clients (`T1056`). It scans the user's active contact list and automatically sends a hardcoded, socially engineered message containing a link to a copy of itself to every online contact (`T1534`). Some variants also contained backdoor functionality (`T1071.001`) or downloaded secondary adware payloads.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was severe disruption of communication networks, reputational damage to the user, and the potential deployment of secondary malware. The most glaring IoC is the user's IM client autonomously sending messages without user interaction. Host-based IoCs include EDR alerts for the creation of randomly named executables in the Windows System directory and the modification of Registry Run keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Opanki and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Opanki is classified as a Backdoor. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Opanki establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Opanki typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Opanki compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Opanki should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What remote administrative and surveillance capabilities does Opanki provide to threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "As an interactive backdoor and remote access tool, Opanki grants operators comprehensive control over the victim host. Common surveillance and management modules include real-time keystroke logging, desktop screen capture, remote VNC streaming, webcam and audio recording, arbitrary shell command execution, reverse proxy pivoting, and bidirectional file transfer capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does Opanki traverse firewalls and sustain resilient command-and-control (C2) connections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Opanki establishes persistent outbound TCP or TLS connections back to threat actor infrastructure, effectively bypassing inbound firewall filtering. To maintain connection resilience against IP takedowns, variants frequently employ dynamic DNS services, fallback command servers, encrypted dead-drop resolvers on social platforms, or DNS over HTTPS (DoH) querying."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1547.001",
    "T1056",
    "T1534"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing (Propagating via IM contact lists)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Link",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1056",
      "name": "Input Capture (Hooking IM client APIs)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Instantly log the infected user out of all corporate and personal Instant Messaging platforms to halt the viral propagation of the worm.",
    "Isolate the endpoint from the network to prevent the worm from downloading any secondary payloads or updates from its C2 server.",
    "Use an enterprise antivirus solution to scan the Windows System directory and remove the Opanki executable and its associated registry hooks.",
    "Instruct the user to notify their contacts that their account was compromised and to ignore any recent links sent from their profile."
  ],
  "what_to_avoid": [
    "Do not assume the threat is modern; Opanki heavily targets obsolete IM protocols (AIM, MSN), meaning an infection on a modern system may be dormant or struggling to execute.",
    "Avoid ignoring the incident; while the worm itself is old, the vector (social engineering via trusted contacts) remains highly effective and may indicate a broader security awareness issue."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}