Self-Propagating Worms & Network Infection
Threat Landscape & Operational Overview
Worms are autonomous, self-propagating malware strains that spread across local networks and the global internet without requiring human intervention or host file attachment. Worms scan network IP ranges for unpatched vulnerabilities (e.g. SMB EternalBlue, RDP BlueKeep), weak administrative credentials, or open network shares. Once a target host is exploited, the worm drops a copy of itself, installs secondary payloads, and immediately turns the infected host into a new propagation node—enabling exponential network-wide contagion in minutes.
🛡️ Enterprise Incident Response & Hardening Guidance
Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:
→ Open Master Guide: Worm & Virus ProtectionPrimary MITRE ATT&CK Tactics & Techniques
Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:
| ID | Technique | Tactic | Observed Operational Behavior |
|---|---|---|---|
T1210 |
Exploitation of Remote Services | Lateral Movement | Exploits network daemon vulnerabilities to replicate without authentication. |
T1046 |
Network Service Scanning | Discovery | Scans local subnets and external CIDR ranges on vulnerable ports (445, 3389). |
T1021.002 |
SMB/Windows Admin Shares | Lateral Movement | Copies executable files across open administrative shares. |
T1080 |
Taint Shared Content | Lateral Movement | Infects files stored on accessible network drives to compromise other users. |
T1078 |
Valid Accounts | Defense Evasion | Brute-forces network credentials to establish remote authenticated connections. |
Actively Weaponized Exploits & Vulnerabilities (8 CVEs)
Adversaries deploying self-propagating worms & network infection frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:
Microsoft Windows Server Service RPC Vulnerability (MS08-067 / Conficker)
Attributed Payloads: brambul, conficker, kolab +2 more
Microsoft Windows Server Service NetprPathCanonicalize Buffer Overflow
Attributed Payloads: allaple, kolab
Microsoft Windows PCT / SSL Handshake Buffer Overflow
Attributed Payloads: lamer, netsky
Microsoft Windows LSASS Buffer Overflow (Sasser Worm)
Attributed Payloads: sasser
Microsoft Windows RPC DCOM Interface Buffer Overflow (Blaster Worm)
Attributed Payloads: blaster
Microsoft Windows Shell Shortcut LNK / PIF Code Execution (Stuxnet)
Attributed Payloads: beebone, lolbot, ludbaruma +4 more
Microsoft Office MSCOMCTL.OCX ActiveX TreeView / ListView Buffer Overflow
Attributed Payloads: lolbot
Microsoft Outlook Express & Internet Mail OLE Embedded Object Execution
Attributed Payloads: netsky
SOC Incident Containment Checklist
Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:
- Immediately segment local network switches and block lateral ports (TCP 445, 139, 3389, 135) at internal firewalls.
- Identify patient-zero and all compromised nodes using network intrusion detection (NIDS) telemetry.
- Deploy emergency security patches (e.g. MS17-010) across all enterprise endpoints and servers.
- Disable SMBv1 across the entire domain and enforce SMB signing and encryption.
- Scan and disinfect network file shares for dropped worm binaries.
- Do not delay network isolation; worms can compromise hundreds of hosts within a matter of minutes.
- Do not leave default or shared local administrator passwords across multiple domain endpoints.
Prominent Malware Families in this Category
Top documented threats ranked by historical prevalence and behavioral signatures:
vobfus
Vobfus (also documented across antimalware products as Win32/Vobfus, Worm:Win32/Vobfus, and WORM_VOBFUS) is a pervasive Windows worm and ...
lamer
Worm:Win32/Lamer is a dual-threat propagation worm and trojan downloader that emerged in the mid-2000s, designed to infiltrate Windows ne...
mira
Trojan:Win32/Mira (also tracked across vendor signatures as Worm:Win32/Mira, distinct from the Linux IoT botnet Mirai) is a prolific Wind...
lolbot
Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging p...
koobface
Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most ...
sfone
Sfone (cataloged across security vendors as Worm:Win32/Sfone, Worm.Win32.SFONE.B, and Trojan:Win32/Sfone!pz) is a self-propagating Window...
ludbaruma
Ludbaruma (identified across antivirus products as Worm:Win32/Ludbaruma.A, Worm:Win32/Ludbaruma!pz, and TrojanDropper:Win32/Ludbaruma) is...
sytro
Sytro (cataloged in antivirus encyclopedias as Worm:Win32/Sytro, P2P-Worm.Win32.Sytro, and Trojan:Win32/Sytro) is a peer-to-peer (P2P) ne...
Complete Directory (38 Families)
Alphabetical index of all tracked malware families cataloged under self-propagating worms & network infection: