{
  "family": "zlob",
  "sample_count": 15,
  "category": "trojan",
  "description": "Zlob (historically one of the most prolific malware families in cybersecurity history, classified across antivirus engines as Trojan:Win32/Zlob, Trojan.Zlob, and Trojan-Downloader.Win32.Zlob) was a massive global trojan ecosystem active from 2005 onwards that infected tens of millions of computers worldwide. Disguised as a required video codec (such as ActiveX Video Codec or VideoLAN plug-in) needed to view online media, Zlob tricks victims into manual installation. Upon execution, Zlob modifies Windows DNS server settings under HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces, redirecting all DNS queries to rogue attacker-controlled DNS servers (DNSChanger). This allows threat actors to hijack web traffic, display fake security alerts, redirect searches to rogue antivirus scareware landing pages, and inject pay-per-click advertisements into browsing sessions.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Zlob",
    "Trojan.Zlob",
    "Win32/Zlob.Trojan",
    "DNSChanger.Zlob",
    "Trojan-Downloader.Win32.Zlob",
    "Zlob Video Codec"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Zlob?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zlob is a historic trojan family that masqueraded as required video codecs to hijack Windows DNS settings and distribute scareware."
      }
    },
    {
      "@type": "Question",
      "name": "How did Zlob lure victims into installing it?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It displayed fake website pop-ups claiming that an updated video codec was required to play requested multimedia clips."
      }
    },
    {
      "@type": "Question",
      "name": "How did Zlob hijack web navigation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It altered system TCP/IP DNS settings to point to attacker-controlled DNS servers, hijacking domain resolutions globally."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware did Zlob commonly promote?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It heavily promoted rogue antivirus and scareware programs (such as SpySheriff and Antivirus Gold) via fabricated error pop-ups."
      }
    },
    {
      "@type": "Question",
      "name": "How do you restore a system infected with Zlob DNSChanger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Reset network adapter DNS configurations to automatic or trusted resolvers (e.g., 1.1.1.1, 8.8.8.8), clean autostart registry entries, and run an antimalware scanner."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1112",
    "T1547.001",
    "T1071.004",
    "T1491",
    "T1189",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Fake Codec)",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547",
      "name": "Boot or Logon Autostart Execution (Winlogon/BHO)",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation via Scareware)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses (DNS Hijacking)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Boot the infected machine into 'Safe Mode with Networking' to bypass the malware's autostart mechanisms and fake AV blockers.",
    "Check and reset the system's DNS settings (IPv4 properties) to ensure traffic is not being routed through malicious servers.",
    "Utilize a standalone, reputable malware removal tool to scan the system, specifically targeting the `System32` directory and BHO registry keys.",
    "Advise the end-user NOT to enter their credit card information into any of the aggressive pop-up warnings."
  ],
  "what_to_avoid": [
    "Do not trust the 'Antivirus' software demanding payment; it is the secondary payload dropped by Zlob.",
    "Avoid attempting manual removal of Zlob DLLs while the OS is running normally, as they are often injected into `explorer.exe` and cannot be deleted."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Zlob",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Zlob"
    },
    {
      "name": "Symantec Security Response - Trojan.Zlob Threat Assessment",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletin/trojan-zlob"
    },
    {
      "name": "MITRE ATT&CK - Modify Registry (T1112)",
      "url": "https://attack.mitre.org/techniques/T1112/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}