{
  "family": "storm",
  "sample_count": 1,
  "category": "botnet",
  "description": "Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infected an estimated 10 million computers worldwide between 2007 and 2008. Storm revolutionized malware architecture by pioneering two foundational cybercrime innovations: the use of the decentralized Overnet/Kademlia P2P communication protocol (eliminating centralized C2 servers) and Fast-Flux DNS service networks. Storm lured victims through sensationalized social engineering email spam capitalizing on European storm disasters (such as '230 dead as storm batters Europe'), celebrity scandals, and holiday greeting cards. The botnet was weaponized for high-volume email spam, financial stock manipulation, and defensive DDoS retaliation attacks against security researchers, CERTs, and spam-tracking organizations (including Spamhaus) that attempted to investigate its infrastructure. Storm served as the direct technological progenitor to subsequent P2P botnets including Waledac and Kelihos before being systematically countered by vendor endpoint removals and Overnet protocol poisoning.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Storm",
    "Storm Worm",
    "Peed",
    "Nuwar",
    "W32/Storm",
    "Dorf"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Storm Worm botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Storm Worm was a massive peer-to-peer botnet that infected an estimated 10 million computers in 2007 using social engineering emails and Fast-Flux DNS."
      }
    },
    {
      "@type": "Question",
      "name": "What architectural innovations did Storm Worm introduce?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Storm was the first major malware to use decentralized Overnet P2P protocols for C2 and Fast-Flux DNS to rapidly cycle IP addresses for bulletproof availability."
      }
    },
    {
      "@type": "Question",
      "name": "How did Storm Worm retaliate against security researchers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Storm automatically initiated retaliatory DDoS attacks against IP addresses and research organizations that probed or monitored its P2P nodes."
      }
    },
    {
      "@type": "Question",
      "name": "What subsequent malware was derived from Storm Worm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Storm Worm's P2P codebase served as the direct foundational predecessor for Waledac and the Kelihos/Hlux botnets."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were exploited by Storm Worm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Storm exploited browser and media vulnerabilities including CVE-2006-4704 and CVE-2007-0038 via drive-by download staging sites."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1568.001",
    "T1071.001",
    "T1498",
    "T1059.003",
    "T1560.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.002",
      "name": "Spearphishing Link",
      "tactic": "initial-access"
    },
    {
      "id": "T1568.001",
      "name": "Fast Flux DNS",
      "tactic": "command-and-control"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "impact"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1560.001",
      "name": "Archive via Utility",
      "tactic": "collection"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2007,
  "lineage": {
    "derived_from": [],
    "variants": [
      "storm worm original (2007)",
      "storm fast-flux edition",
      "waledac (successor)",
      "kelihos (successor)"
    ]
  },
  "attribution": [
    {
      "actor": "Russian Cybercrime Underground",
      "confidence": "high"
    },
    {
      "actor": "Storm Botnet Syndicate",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2006-4704",
    "CVE-2007-0038"
  ],
  "c2_profile": {
    "protocols": [
      "P2P",
      "HTTP",
      "DNS"
    ],
    "ports": [
      80,
      407,
      53
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "1d2c6762391ea2837493a109a927ec0bc1d34c2ab79d67e5ff825c88b64e5257",
      "841893d5f308e7ef9e4345eb6eeecb321a59051d95dc48e77a9497e68db30058"
    ],
    "delivery": [
      "viral_email_spam",
      "drive_by_downloads"
    ],
    "persistence": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Service Injection"
    ]
  },
  "sources": [
    {
      "name": "Bruce Schneier Security Analysis: The Storm Worm",
      "url": "https://www.schneier.com/blog/archives/2007/10/the_storm_worm.html"
    },
    {
      "name": "US-CERT Vulnerability Note: Storm Worm Propagation",
      "url": "https://www.cisa.gov/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2007-0038",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-0038"
    }
  ],
  "containment_steps": [
    "Block Overnet / eDonkey P2P protocol traffic on perimeter firewalls.",
    "Deploy DNS response inspection rules detecting short-TTL fast-flux domain patterns.",
    "Filter inbound email for social engineering headlines referencing current breaking news and natural disasters.",
    "Apply security patch MS07-017 addressing Windows Animated Cursor vulnerability CVE-2007-0038."
  ],
  "what_to_avoid": [
    "Do not click executable download links in breaking-news email alerts from unverified news domains.",
    "Avoid allowing unrestricted outbound P2P networking protocols from corporate workstations.",
    "Never probe live botnet C2 nodes from non-isolated analysis networks."
  ],
  "target_industries": [
    "consumers",
    "financial_services",
    "isp_providers",
    "telecommunications"
  ],
  "motivation": "Spam Syndication, Stock Manipulation & DDoS Retaliation",
  "threat_actors": [
    "Storm Syndicate"
  ],
  "target_geographies": [
    "US",
    "DE",
    "GB",
    "FR",
    "NL",
    "AU"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "command-and-control",
    "impact"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}