{
  "family": "palevo",
  "sample_count": 106,
  "category": "botnet",
  "description": "Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet that compromised over 12.7 million computers across 190 countries between 2008 and 2010. Authored by Slovenian malware developer Matjaž Škorjanc ('Iserdo'), the Butterfly Bot framework was sold commercially on underground forums for $500 to $2,000 to cybercrime affiliates, most notably the 'Denuvō' crew in Spain. Palevo spread aggressively via USB removable storage autorun exploits, MSN Messenger instant messaging worm propagation, and peer-to-peer file sharing networks. Infected systems were leveraged to execute massive distributed denial-of-service (DDoS) attacks, steal banking credentials, deploy browser webinjects, and install rogue security software. In December 2009, a collaborative international task force comprising the Spanish Guardia Civil, the FBI, and Panda Security executed Operation Mariposa, seizing command servers and arresting Spanish operators 'Netkairo' (Florencio Carro Ruiz), 'Ostiator', and 'Johny-K'. In July 2010, Slovenian police and the FBI arrested author Matjaž Škorjanc in Maribor, leading to his federal indictment and conviction in the District of Columbia.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Palevo",
    "Worm:Win32/Palevo",
    "Butterfly Bot",
    "Mariposa",
    "Rkit.Palevo"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Palevo (Mariposa) botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Palevo, also known as Butterfly Bot and Mariposa, was one of the largest botnets in history, infecting over 12.7 million computers worldwide."
      }
    },
    {
      "@type": "Question",
      "name": "Who developed Palevo and how was he arrested?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Palevo was authored by Slovenian developer Matjaž Škorjanc ('Iserdo'), who was arrested by Slovenian police and the FBI in 2010 and convicted in US federal court."
      }
    },
    {
      "@type": "Question",
      "name": "How did Palevo propagate across systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Palevo propagated using weaponized autorun.inf files on USB drives, peer-to-peer file sharing networks, and malicious instant messaging links."
      }
    },
    {
      "@type": "Question",
      "name": "What was Operation Mariposa?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operation Mariposa was a joint international operation by Spanish Guardia Civil, the FBI, and Panda Security in 2009 that dismantled the botnet's C2 servers and arrested its operators in Spain."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were targeted by Palevo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Palevo exploit modules leveraged Windows network vulnerabilities including MS08-067 (CVE-2008-4250) and shortcut vulnerability CVE-2010-2568."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1566.002",
    "T1055",
    "T1185",
    "T1071.001",
    "T1498"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "initial-access"
    },
    {
      "id": "T1566.002",
      "name": "Spearphishing Link",
      "tactic": "initial-access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "collection"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "impact"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2008,
  "lineage": {
    "derived_from": [],
    "variants": [
      "butterfly bot v1",
      "mariposa core",
      "yahos (facebook worm derivative)"
    ]
  },
  "attribution": [
    {
      "actor": "Matjaž Škorjanc (Iserdo, Author)",
      "confidence": "high"
    },
    {
      "actor": "Spanish Denuvō Group (Netkairo)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2008-4250",
    "CVE-2010-2568"
  ],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "TCP",
      "UDP"
    ],
    "ports": [
      80,
      443,
      8080
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "4b6f756ce1bc7b2675685938bf8c679237000d02ee0761e065e1db5451996df7",
      "93ab0a927ec0bc1d34c2ab79d67e5ff825c88b64e5257e841893d5f308e7ef9e"
    ],
    "delivery": [
      "usb_autorun",
      "instant_messaging_links",
      "p2p_networks"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Explorer Injection"
    ]
  },
  "sources": [
    {
      "name": "FBI Press Release: Butterfly Bot Mastermind Convicted in International Cyber Conspiracy",
      "url": "https://www.fbi.gov/news/stories/butterfly-bot-mastermind-sentenced"
    },
    {
      "name": "Spanish Guardia Civil & Panda Security: Operation Mariposa Technical Report",
      "url": "https://www.pandasecurity.com/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2008-4250",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4250"
    }
  ],
  "containment_steps": [
    "Disable Windows USB Autorun and AutoPlay globally via Group Policy (GPO).",
    "Block outbound HTTP communication matching known Palevo dynamic DNS domains.",
    "Isolate infected hosts to prevent lateral spread across local network shares.",
    "Apply security patch MS08-067 to prevent unauthenticated remote code execution via Server Service."
  ],
  "what_to_avoid": [
    "Never insert unverified USB flash drives into corporate endpoints without hardware sanitization.",
    "Avoid clicking unsolicited shortened links sent via collaborative chat or messaging software.",
    "Do not allow unprivileged users to execute files from removable media."
  ],
  "target_industries": [
    "consumers",
    "financial_services",
    "education",
    "corporate_networks"
  ],
  "motivation": "Financial Theft, DDoS for Hire & Botnet Commercialization",
  "threat_actors": [
    "Matjaž Škorjanc (Iserdo)",
    "Florencio Carro Ruiz (Netkairo)"
  ],
  "target_geographies": [
    "ES",
    "US",
    "DE",
    "GB",
    "IN",
    "MX",
    "BR"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "collection",
    "impact"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}