{
  "family": "yahlover",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "Worm:Win32/Yahlover (also known as the **Yahoo Messenger Worm**) is a prolific mass-mailing and instant messaging worm that aggressively spread by hijacking Yahoo Messenger accounts to blast malicious links to the victim's entire contact list. Beyond its massive propagation capabilities, Yahlover is highly destructive, acting as a file infector (`.exe` and `.dll` files) and aggressively disabling endpoint security software.<br><br><b>Understanding the Yahlover Worm</b><br>To an infected user, the computer might become unstable, and their friends would complain about receiving strange links via Yahoo Messenger. For security analysts, Yahlover represents a severe, dual-threat incident. It acts as an aggressive network worm causing massive congestion, and simultaneously acts as a file infector, meaning simply deleting the worm executable is not enough to remediate the endpoint, as legitimate system files have been structurally altered.<br><br><b>Propagation and File Infection Mechanics</b><br>The infection cycle begins when a victim clicks a malicious link received via Instant Messenger (`T1534`) or opens an infected email attachment. Upon execution (`T1204.002`), Yahlover establishes persistence via multiple Registry Run keys (`T1547.001`). Its primary propagation mechanism is hijacking the active Yahoo Messenger session to send messages containing a link to a copy of itself to all online contacts. Concurrently, it acts as a File Infector (`T1055.001` - logic injection), searching the hard drive for executable files (`.exe`, `.scr`, `.pif`) and physically appending its malicious code to the legitimate binaries. Furthermore, Yahlover aggressively terminates processes and deletes registry keys associated with hundreds of popular antivirus and firewall products (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the hijacking of communication platforms, the corruption of legitimate executables, and the disabling of endpoint security. The most glaring IoC is an overwhelming surge in outbound IM traffic or automated messages originating from the user's account. Host-based IoCs include EDR alerts for the sudden, forceful termination of antivirus processes and the modification (file size changes and hash changes) of hundreds of legitimate `.exe` files across the `C:\\` drive.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Yahlover and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yahlover is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Yahlover establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yahlover typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Yahlover compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Yahlover should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Yahlover leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yahlover frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Yahlover maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yahlover often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1534",
    "T1562.001",
    "T1055.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing (Propagating via Instant Messenger)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection (File Infection logic)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Killing AV processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately to halt the IM propagation engine and stop it from spamming contacts.",
    "Ensure the endpoint's antivirus is actually running, as Yahlover explicitly targets and disables security software.",
    "Because Yahlover is a file infector, standard manual deletion will not work. You must use an enterprise antivirus solution capable of 'cleaning' (disinfecting) the appended malicious code from legitimate `.exe` files.",
    "If disinfection fails or the system is heavily corrupted, a complete OS rebuild from secure backups is required."
  ],
  "what_to_avoid": [
    "Do not trust messages containing links sent via IM from infected users, even if they are known contacts.",
    "Avoid assuming the threat is remediated by deleting the initial dropped file; the file infector component has likely already compromised dozens of legitimate system files."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}