{
  "family": "vjworm",
  "sample_count": 2,
  "category": "backdoor",
  "description": "Worm:VBS/Vjworm (and its variants like JS/Vjworm) is a highly aggressive, self-propagating worm written in scripting languages (Visual Basic Script or JavaScript). Its defining characteristic is its heavy reliance on Removable Media (USB drives) for propagation (`T1091`), making it a significant threat to air-gapped or poorly segmented operational technology (OT) environments.<br><br><b>Understanding VJWorm</b><br>To an end-user, an infection often starts when they plug in an infected USB drive; their legitimate files appear to have vanished, replaced by 'shortcuts' that look like their folders. For a security team, VJWorm is a highly visible, persistent nuisance that indicates a failure in USB device control policies. While primarily a worm, it also functions as a backdoor, allowing the attacker to download additional payloads or steal data.<br><br><b>Execution and Propagation Mechanics</b><br>VJWorm is distributed initially via malicious downloads or spam, but its primary vector is lateral movement via USB. When a clean USB drive is inserted into an infected machine, VJWorm copies its heavily obfuscated script file (often `.vbs`, `.js`, or `.wsf`) to the drive. Crucially, it then hides all legitimate files and folders on the USB drive (`T1564.001`) and creates Windows Shortcut (`.lnk`) files (`T1566.001`) with the same names as the hidden folders. When a user on a *new* machine clicks the shortcut to open their 'folder', the shortcut actually executes the VJWorm script via `wscript.exe`, infects the new host, and *then* opens the legitimate folder to avoid suspicion. It establishes persistence on the host via the Registry Run keys.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from significant operational disruption (network congestion, hidden files) to data exfiltration via the backdoor capability. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing from suspicious locations (like the root of a USB drive or `%AppData%`), and the presence of suspicious `.lnk` files on removable media. Network IoCs include the script reaching out to dynamic DNS domains for C2 instructions.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Vjworm and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vjworm is classified as a Backdoor. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vjworm establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vjworm typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Vjworm compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Vjworm should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What remote administrative and surveillance capabilities does Vjworm provide to threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "As an interactive backdoor and remote access tool, Vjworm grants operators comprehensive control over the victim host. Common surveillance and management modules include real-time keystroke logging, desktop screen capture, remote VNC streaming, webcam and audio recording, arbitrary shell command execution, reverse proxy pivoting, and bidirectional file transfer capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vjworm traverse firewalls and sustain resilient command-and-control (C2) connections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vjworm establishes persistent outbound TCP or TLS connections back to threat actor infrastructure, effectively bypassing inbound firewall filtering. To maintain connection resilience against IP takedowns, variants frequently employ dynamic DNS services, fallback command servers, encrypted dead-drop resolvers on social platforms, or DNS over HTTPS (DoH) querying."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1564.001",
    "T1547.001",
    "T1059.005",
    "T1091"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (The core propagation mechanism via USB)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic (Execution of the payload via wscript)",
      "tactic": "Execution"
    },
    {
      "id": "T1564.001",
      "name": "Hide Artifacts: Hidden Files and Directories (Hiding the victim's legitimate files on the USB)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Host persistence)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately enforce USB port blocking (Device Control) across the enterprise to halt lateral propagation.",
    "Isolate infected machines to prevent the worm from reaching out to its C2 server or attempting network share propagation.",
    "Run a script to unhide all files (`attrib -h -s -r /s /d *.*`) and delete the malicious `.lnk` files and `.vbs`/`.js` payloads on affected drives.",
    "Review the Registry Run keys (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) for entries executing `wscript.exe`."
  ],
  "what_to_avoid": [
    "Do not simply delete the `.lnk` files on the USB drive; you must unhide the user's actual files to restore functionality.",
    "Avoid allowing Autoplay/Autorun for removable media, as this facilitates the automatic execution of some worm variants."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}