{
  "family": "rustock",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 and its dramatic federal takedown in March 2011. Comprising over 1.5 million infected Windows systems globally, Rustock was estimated at its peak to be responsible for pumping between 30% and 40% of the entire world's daily email spam volume (generating more than 30 billion unsolicited messages per day advertising illicit pharmaceuticals, counterfeit watches, and stock manipulation schemes). Architected by a master rootkit developer operating under the pseudonym 'Cosma' (associated in research with Russian national Dmitrij Sergeevich Nechvolod), Rustock executed as a deeply embedded Windows kernel driver that subverted the System Service Dispatch Table (SSDT), modified direct kernel object tables, and injected threads directly into system processes without dropping conventional on-disk files. In March 2011, Microsoft's Digital Crimes Unit (DCU), partnered with Pfizer, FireEye, and the US Marshals Service, executed Operation b107 under a landmark federal court order, simultaneously raiding command data centers in seven US cities, severing upstream ISP links, and permanently disabling the botnet.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Rustock",
    "Costrat",
    "Rootkit.Win32.Rustock",
    "Spam-Mailbot.Rustock"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Rustock botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rustock was a massive kernel-mode rootkit botnet of 1.5 million computers that pumped up to 40% of the world's daily email spam before being dismantled in 2011."
      }
    },
    {
      "@type": "Question",
      "name": "How did Rustock evade antivirus detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rustock operated as a kernel driver hooking SSDT syscalls, hiding its network sockets, encrypting communications via RC4, and running completely in memory without files on disk."
      }
    },
    {
      "@type": "Question",
      "name": "How was Rustock dismantled by Microsoft?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In March 2011, Microsoft DCU, Pfizer, and the US Marshals Service executed Operation b107, obtaining federal court warrants to seize command servers across seven US data centers."
      }
    },
    {
      "@type": "Question",
      "name": "Who operated the Rustock botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Microsoft court filings and security investigations identified the developer and operator as Russian national Dmitrij Sergeevich Nechvolod ('Cosma')."
      }
    },
    {
      "@type": "Question",
      "name": "What was the primary motive of the Rustock botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rustock was operated for financial profit through massive spam syndication advertising unlicensed pharmaceuticals, fake luxury goods, and stock manipulation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1014",
    "T1055",
    "T1566.002",
    "T1071.001",
    "T1114.001",
    "T1059.003"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1566.002",
      "name": "Spearphishing Link",
      "tactic": "initial-access"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection",
      "tactic": "collection"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2006,
  "lineage": {
    "derived_from": [],
    "variants": [
      "rustock.a (2006)",
      "rustock.b (advanced rootkit driver)",
      "rustock.c (rc4 encryption & self-defense)"
    ]
  },
  "attribution": [
    {
      "actor": "Dmitrij Sergeevich Nechvolod (Cosma)",
      "confidence": "high"
    },
    {
      "actor": "Russian Cybercrime Spambot Underground",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2006-0003",
    "CVE-2008-2244"
  ],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "TCP",
      "RC4"
    ],
    "ports": [
      80,
      443,
      25
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "4345eb6eeecb321a59051d95dc48e77a9497e68db30058b73ad6ba16dc681428",
      "93ab0a927ec0bc1d34c2ab79d67e5ff825c88b64e5257e841893d5f308e7ef9e"
    ],
    "delivery": [
      "trojan_droppers",
      "drive_by_downloads"
    ],
    "persistence": [
      "Kernel Service Driver",
      "SSDT Hooking Architecture"
    ]
  },
  "sources": [
    {
      "name": "Microsoft On the Issues: Operation b107 - Rustock Botnet Takedown",
      "url": "https://blogs.microsoft.com/on-the-issues/2011/03/17/taking-down-botnets-rustock-and-operation-b107/"
    },
    {
      "name": "FireEye Labs Rustock Technical Teardown",
      "url": "https://www.fireeye.com/blog/threat-research.html"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2006-0003",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0003"
    }
  ],
  "containment_steps": [
    "Execute offline system kernel scans using specialized rootkit removal environments (Windows PE).",
    "Block outbound SMTP connections (port 25) from general client endpoints on perimeter egress firewalls.",
    "Isolate compromised endpoints to prevent internal network scanning and email credential harvesting.",
    "Apply security updates to close legacy Windows operating system vulnerabilities CVE-2006-0003 and CVE-2008-2244."
  ],
  "what_to_avoid": [
    "Do not rely solely on user-mode task manager utilities to detect running rootkit processes.",
    "Avoid allowing unrestricted outbound port 25 traffic from unmanaged client workstations.",
    "Do not execute unknown installer programs downloaded from unverified third-party websites."
  ],
  "target_industries": [
    "consumers",
    "pharmaceuticals",
    "financial_services",
    "telecommunications"
  ],
  "motivation": "Illicit Pharmaceutical Spam & Financial Fraud",
  "threat_actors": [
    "Dmitrij Nechvolod (Cosma)"
  ],
  "target_geographies": [
    "US",
    "RU",
    "DE",
    "GB",
    "CA",
    "FR"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "defense-evasion",
    "persistence",
    "collection"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}