{ "family": "tdss", "sample_count": 35, "category": "rootkit", "description": "TDSS (universally recognized across threat intelligence research and vendor taxonomies as Rootkit:Win32/TDSS, Trojan:Win32/Alureon, W32.Tidserv, and TDL-4) is one of the most technologically advanced and resilient rootkit and bootkit botnet families in computing history, active since 2008. Over four successive architectural generations (TDL-1 through TDL-4), TDSS pioneered groundbreaking low-level evasion techniques, including infecting the Master Boot Record (MBR) and Volume Boot Record (VBR) to execute malicious ring-0 code before the Windows kernel loads, bypassing 64-bit kernel mode code signing (KMCS) requirements on Windows 7. TDSS establishes a hidden, encrypted virtual file system at the very end of physical hard disk drives, inaccessible to the Windows operating system APIs. Functioning as a formidable cybercrime hosting infrastructure, TDSS hooked low-level disk I/O drivers (atapi.sys, miniport drivers), manipulated search engine results, intercepted banking communications, established a peer-to-peer (P2P) Kad-like C2 communication overlay to resist domain takedowns, and rented its botnet pipeline to distribute secondary ransomware, click-fraud modules, and rogue antivirus software.", "cta": "Published by the SystemHelpdesk Threat Intelligence Team.", "aliases": [ "Rootkit:Win32/TDSS", "Trojan:Win32/Alureon", "Rootkit.Win32.TDSS.tdl4", "W32.Tidserv", "TDL-4 Rootkit", "Backdoor.Win32.TDSS", "Alureon Bootkit" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is the TDSS (TDL-4 / Alureon) rootkit?", "acceptedAnswer": { "@type": "Answer", "text": "TDSS is a notorious advanced persistent rootkit and bootkit that infects the Master Boot Record to execute malicious code before the Windows kernel boots." } }, { "@type": "Question", "name": "How did TDL-4 bypass 64-bit Windows kernel driver signing?", "acceptedAnswer": { "@type": "Answer", "text": "By infecting the Master Boot Record, TDL-4 executed in 16-bit real mode prior to Windows initialization, disabling driver signature enforcement (KMCS) directly in memory." } }, { "@type": "Question", "name": "Where does TDSS store its malicious files on the hard drive?", "acceptedAnswer": { "@type": "Answer", "text": "TDSS stores its components in a hidden, encrypted virtual file system located in raw disk sectors at the very end of physical hard drives, invisible to Windows APIs." } }, { "@type": "Question", "name": "How did the TDL-4 botnet maintain command and control resilience?", "acceptedAnswer": { "@type": "Answer", "text": "It utilized a decentralized peer-to-peer (P2P) communication architecture based on the Kad network protocol, making the botnet virtually immune to centralized domain takedowns." } }, { "@type": "Question", "name": "How can systems be disinfected from a TDSS bootkit infection?", "acceptedAnswer": { "@type": "Answer", "text": "Use specialized offline bootable removal media (such as Kaspersky TDSSKiller), repair the Master Boot Record via Windows Recovery Environment (bootrec /fixmbr), and update storage firmware." } } ], "faq_count": 5, "mitre_attack": [ "T1542.003", "T1014", "T1547.006", "T1071.001", "T1562.001" ], "cisa_advisory": null, "last_updated": "2026-10-15", "first_seen": 2008, "threat_actor": null, "delivery_mechanism": [ "Exploit Kits (Blackhole, Phoenix)", "Drive-by Downloads", "Trojanized Video Codecs & Media Players" ], "target_platforms": [ "Windows 7 (32-bit & 64-bit)", "Windows Vista", "Windows XP", "Windows Server 2008", "Windows Server 2003" ], "capabilities": [ "MBR / VBR Bootkit Sub-OS Loading", "Bypassing 64-bit Kernel Mode Driver Signing (KMCS)", "Hidden Encrypted Disk Virtual File System", "Low-Level Storage Driver Hooking (atapi.sys)", "Decentralized Peer-to-Peer (P2P) C2 Overlay", "DNS Interception & Search Result Redirection" ], "technical_analysis": { "file_types": [ "Kernel Mode Driver (.sys)", "MBR Code Block (512 bytes)", "Encrypted Virtual Disk Image" ], "network_signatures": [ "Outbound UDP traffic on custom ports establishing encrypted Kad-style P2P gossip protocol connections", "DNS query manipulation intercepting Google/Bing search links and redirecting to advertising landing pages" ], "evasion_techniques": [ "Executing in ring-0 prior to the initialization of the Windows kernel and endpoint security drivers", "Hooking the I/O completion routines of disk storage drivers to return original uninfected MBR bytes when read by antivirus utilities", "Storing configuration and driver modules in unpartitioned hard disk sectors beyond the filesystem boundary" ] }, "indicators_of_compromise": { "file_hashes": [ "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b", "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c" ], "registry_keys": [ "HKLM\\SYSTEM\\CurrentControlSet\\Services\\tdss", "HKLM\\SYSTEM\\CurrentControlSet\\Services\\tdl4driver" ], "file_paths": [ "\\Device\\Harddisk0\\DR0 (Infected Sector 0 MBR)", "%SystemRoot%\\System32\\drivers\\tdss.sys" ] }, "defensive_measures": [ "Enable UEFI Secure Boot on modern systems to prevent unauthorized bootloaders and MBR modifications", "Utilize specialized bootkit scanner utilities like TDSSKiller from an offline boot environment", "Implement endpoint isolation immediately upon detecting low-level storage driver hooking" ], "sources": [ { "name": "Kaspersky Securelist - TDL-4: The Top Dog of Botnets In-Depth Analysis", "url": "https://securelist.com" }, { "name": "Microsoft Defender Threat Encyclopedia - Rootkit:Win32/TDSS", "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rootkit:Win32/TDSS" }, { "name": "ESET Research - The Evolution of TDL: From Rootkit to Bootkit", "url": "https://www.welivesecurity.com" } ], "lineage": { "derived_from": [], "variants": [ "TDL-1", "TDL-2", "TDL-3 (Alureon)", "TDL-4", "Rootkit:Win32/TDSS.gen" ] }, "motivation": "Sub-OS Persistence, Botnet Infrastructure & Large-Scale Crimeware Monetization", "sample_hashes": [] }