Self-Propagating Worms & Network Infection

Threat Class: Self-Replicating Autonomous Threat Tracked Families: 2 Severity: CRITICAL MITRE ATT&CK Aligned

Threat Landscape & Operational Overview

Worms are autonomous, self-propagating malware strains that spread across local networks and the global internet without requiring human intervention or host file attachment. Worms scan network IP ranges for unpatched vulnerabilities (e.g. SMB EternalBlue, RDP BlueKeep), weak administrative credentials, or open network shares. Once a target host is exploited, the worm drops a copy of itself, installs secondary payloads, and immediately turns the infected host into a new propagation node—enabling exponential network-wide contagion in minutes.

🛡️ Enterprise Incident Response & Hardening Guidance

Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:

→ Open Master Guide: Worm & Virus Protection

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

ID Technique Tactic Observed Operational Behavior
T1210 Exploitation of Remote Services Lateral Movement Exploits network daemon vulnerabilities to replicate without authentication.
T1046 Network Service Scanning Discovery Scans local subnets and external CIDR ranges on vulnerable ports (445, 3389).
T1021.002 SMB/Windows Admin Shares Lateral Movement Copies executable files across open administrative shares.
T1080 Taint Shared Content Lateral Movement Infects files stored on accessible network drives to compromise other users.
T1078 Valid Accounts Defense Evasion Brute-forces network credentials to establish remote authenticated connections.

Actively Weaponized Exploits & Vulnerabilities (3 CVEs)

Adversaries deploying self-propagating worms & network infection frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:

CVE-2010-2568 CVSS 9.3 CRITICAL

Microsoft Windows Shell Shortcut LNK / PIF Code Execution (Stuxnet)

Attributed Payloads: ramnit, wapomi

View Exploitation Dossier →
CVE-2014-1761 CVSS 9.3 CRITICAL

Microsoft Word RTF Parsing Memory Corruption (MS14-017)

Attributed Payloads: ramnit

View Exploitation Dossier →
CVE-2013-2551 CVSS 9.3 CRITICAL

Microsoft Internet Explorer VML Integer Overflow (Use-After-Free)

Attributed Payloads: ramnit

View Exploitation Dossier →
→ Explore all 63 weaponized vulnerabilities in our master CVE Exploitation Matrix

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

  1. Immediately segment local network switches and block lateral ports (TCP 445, 139, 3389, 135) at internal firewalls.
  2. Identify patient-zero and all compromised nodes using network intrusion detection (NIDS) telemetry.
  3. Deploy emergency security patches (e.g. MS17-010) across all enterprise endpoints and servers.
  4. Disable SMBv1 across the entire domain and enforce SMB signing and encryption.
  5. Scan and disinfect network file shares for dropped worm binaries.
⚠️ Critical Mistakes to Avoid:
  • Do not delay network isolation; worms can compromise hundreds of hosts within a matter of minutes.
  • Do not leave default or shared local administrator passwords across multiple domain endpoints.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

ramnit

EMBER Samples: 20,595

Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010.

View Profile & Rules →

wapomi

EMBER Samples: 5,191

Wapomi (widely documented by antivirus laboratories as Virus.Wapomi or Otwycal) is a parasitic polymorphic PE file infector and worm that...

View Profile & Rules →

Complete Directory (2 Families)

Alphabetical index of all tracked malware families cataloged under self-propagating worms & network infection: