{
  "family": "taterf",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Worm:Win32/Taterf is a highly prevalent, self-replicating worm primarily designed to steal login credentials for popular Massively Multiplayer Online Role-Playing Games (MMORPGs) like World of Warcraft and Lineage. It gained massive notoriety for its aggressive propagation mechanisms, particularly its reliance on infecting removable USB drives and traversing open network shares.<br><br><b>Understanding Taterf (USB Worms)</b><br>To an end-user, a Taterf infection might go unnoticed until their valuable online gaming accounts are compromised and stripped of virtual assets. For a network administrator, Taterf is a severe nuisance that highlights poor network segregation and the dangers of unmanaged removable media. While its primary goal is gaming credential theft (`T1003`), its propagation methods cause significant 'background noise' and risk on corporate networks.<br><br><b>Execution and Propagation Mechanics</b><br>Taterf spreads aggressively via Lateral Movement. When an infected USB drive is inserted into a machine, Windows AutoRun (if enabled) automatically executes the worm (`T1091`). Once active, the worm copies itself to the Windows system folder and establishes persistence via the Registry Run keys (`T1547.001`). It then continually monitors for newly inserted USB drives, copying itself and a hidden `autorun.inf` file to them. Furthermore, it actively scans the local network for open SMB shares, attempting to copy its executable to any accessible network drives (`T1080`). To protect itself, Taterf attempts to terminate processes associated with popular antivirus and analysis tools (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is credential theft and network congestion. Host-based IoCs include the presence of `autorun.inf` files and hidden executables on the root of USB drives, and anomalous registry modifications ensuring startup. EDR solutions may flag the worm's attempts to forcefully terminate security processes. Network IoCs include excessive SMB traffic attempting to write executables to shared drives.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Taterf and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Taterf is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Taterf establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Taterf typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Taterf compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Taterf should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Taterf leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Taterf frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Taterf maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Taterf often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1080",
    "T1003",
    "T1091",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (USB Autorun)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1080",
      "name": "Taint Shared Content (Infecting network SMB shares)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Killing AV processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1003",
      "name": "OS Credential Dumping (Targeting game clients)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Globally disable the Windows AutoRun / AutoPlay feature via Group Policy to immediately halt the primary propagation vector.",
    "Restrict write access to root network shares and monitor for the creation of unauthorized executable files.",
    "Run a comprehensive AV scan across all endpoints and actively sanitize any inserted USB drives.",
    "Enforce strict network segmentation to limit the worm's ability to scan and infect adjacent subnets."
  ],
  "what_to_avoid": [
    "Do not simply delete the worm from a single endpoint without sanitizing associated USB drives; reinfection will occur immediately upon reinsertion.",
    "Avoid allowing unrestricted SMB file sharing across the entire enterprise, as this enables rapid worm propagation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}