{
  "family": "zeroaccess",
  "sample_count": 28,
  "category": "rootkit",
  "description": "ZeroAccess (also known worldwide as Sirefef and classified under signatures including Rootkit:Win32/Sirefef, Trojan:Win32/ZeroAccess, and Backdoor:Win32/Sirefef) is one of the most sophisticated and prolific peer-to-peer (P2P) botnets and kernel-mode rootkits in cybersecurity history, active from 2009 until major industry sinkholing disruptions in 2013–2014. ZeroAccess infected over 2 million endpoints globally, monetized primarily through massive Bitcoin mining and search engine click-fraud operations. The malware employs advanced rootkit techniques, overwriting system drivers, modifying Master Boot Records (MBR), creating hidden encrypted NTFS alternate data stream (ADS) volumes, and hooking kernel functions to conceal its presence. It communicates across a decentralized P2P Kad-like mesh network, allowing resilient distribution of binary updates and click-fraud tasks without relying on centralized C2 servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Rootkit:Win32/Sirefef",
    "Trojan:Win32/ZeroAccess",
    "Rootkit:Win32/ZeroAccess",
    "Win32/Sirefef",
    "Backdoor:Win32/Sirefef",
    "Sirefef Rootkit"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the ZeroAccess (Sirefef) rootkit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZeroAccess is a landmark kernel-mode rootkit and P2P botnet that infected millions of computers for click-fraud and Bitcoin mining."
      }
    },
    {
      "@type": "Question",
      "name": "How does ZeroAccess conceal itself on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It overwrites legitimate system drivers, creates hidden NTFS encrypted volumes, and hooks kernel functions to hide files and network traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does the ZeroAccess botnet communicate without central servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses a decentralized Peer-to-Peer (P2P) UDP protocol where infected nodes discover and share tasks with each other directly."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious payloads were executed by ZeroAccess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deployed CPU/GPU Bitcoin mining modules and click-fraud engines that hijacked search results and generated millions in fraudulent ad revenue."
      }
    },
    {
      "@type": "Question",
      "name": "How was the ZeroAccess botnet disrupted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Microsoft, Europol, and industry partners executed coordinated legal and technical sinkholing operations in December 2013 to sever the P2P network."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1014",
    "T1542.003",
    "T1547.001",
    "T1055",
    "T1496"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2009,
  "threat_actor": null,
  "delivery_mechanism": [
    "Exploit Kits (Blackhole, Bleeding Life)",
    "Trojanized Keygens & Pirated Software",
    "Drive-by Download Infections"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP",
    "Windows Server 2008"
  ],
  "capabilities": [
    "Kernel-Mode Driver Overwriting & Hooking",
    "Decentralized Peer-to-Peer (P2P) UDP C2 Mesh",
    "Search Engine Click-Fraud Redirection",
    "Cryptocurrency Mining (Bitcoin)",
    "Hidden Encrypted NTFS File Storage"
  ],
  "technical_analysis": {
    "file_types": [
      "Kernel Driver (.sys)",
      "Win32 PE Executable",
      "Encrypted Volume Container"
    ],
    "network_signatures": [
      "High-frequency inbound and outbound UDP traffic across random high-numbered ports exchanging 16-byte encrypted P2P peer lists",
      "HTTP GET requests redirecting search queries through click-fraud affiliate tracking ad networks"
    ],
    "evasion_techniques": [
      "Disabling Windows Defender, Windows Firewall, and Security Center services",
      "Injecting click-fraud threads into explorer.exe and services.exe from kernel mode"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9cb2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0",
      "adc3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\Sirefef",
      "HKLM\\SOFTWARE\\Classes\\CLSID\\{F3130CDB-AA52-4C3A-AB32-87FFC6C23327}"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\Drivers\\sirefef.sys",
      "%AppData%\\{F3130CDB-AA52-4C3A-AB32-87FFC6C23327}\\@.cfg",
      "%SystemRoot%\\Installer\\{F3130CDB-AA52-4C3A-AB32-87FFC6C23327}\\U\\000000cb"
    ]
  },
  "defensive_measures": [
    "Enforce Driver Signature Enforcement (DSE) to prevent loading unsigned or compromised kernel drivers",
    "Deploy boot-level verification tools and Secure Boot to prevent MBR/VBR rootkit modifications",
    "Monitor network firewalls for abnormal P2P UDP packet storms across random ports"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Rootkit:Win32/Sirefef",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rootkit:Win32/Sirefef"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Rootkit.Win32.Sirefef",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Rootkit:Win32/Sirefef.A",
      "Trojan:Win32/ZeroAccess.B"
    ]
  },
  "motivation": "Click-Fraud Monetization, Bitcoin Mining & Large-Scale Botnet Control",
  "sample_hashes": []
}