Cycbot

Overview

Backdoor:Win32/Cycbot is a notorious, highly persistent botnet agent and backdoor primarily known for executing massive click-fraud campaigns and hijacking search engine results. Initially discovered around 2010, Cycbot infects endpoints to forcefully route the victim's web traffic through attacker-controlled proxies, generating illicit revenue by simulating clicks on paid advertisements and acting as a conduit for secondary malware.

Understanding the Cycbot Botnet
To an end-user, a Cycbot infection manifests as severe browser instability, dramatically slowed internet speeds, and the constant redirection of their Google or Bing searches to irrelevant, ad-heavy websites. For a security analyst, Cycbot represents a severe compromise of network integrity. The malware effectively Man-in-the-Middles (MitM) the endpoint's web traffic, exposing the organization to data interception and acting as a persistent backdoor that the botmaster can use to deploy ransomware later.

Execution and Interception Mechanics
Cycbot is typically distributed via exploit kits or bundled with rogue software. Upon execution, it injects itself deeply into the `explorer.exe` process (`T1055`) to evade detection and establish a footprint. It ensures persistence by creating complex, randomly named Registry Run keys (`T1547.001`). The core functionality involves acting as a local proxy (`T1090`). Cycbot modifies the Windows network settings and hooks browser APIs (`T1185`) to intercept all HTTP/HTTPS traffic. When a user searches for a term, Cycbot queries its Command and Control (C2) server (`T1071.001`), which replies with a list of monetized URLs. Cycbot then seamlessly redirects the user's browser to these URLs, simulating legitimate ad clicks (`T1111`).

Indicators of Compromise & Impact
The impact is a degraded user experience, massive generation of fraudulent web traffic, and the potential for credential interception. Incident responders will observe anomalous outbound network traffic on standard web ports connecting to known Cycbot C2 infrastructure. Host-based IoCs include EDR alerts for process injection into `explorer.exe` and unauthorized modifications to the system's local proxy settings (e.g., altering the `ProxyServer` registry key).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_CYCBOT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cycbot"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "cycbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Cycbot (Ransomware) Execution & Triage
id: 219fbbab-e95a-52f6-acfb-f3895c63d816
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Cycbot malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/cycbot
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1185
- attack.t1111
- attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_CYCBOT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cycbot tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "cycbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately; the botnet proxy can be used to intercept sensitive corporate data or download secondary payloads.
2. Use EDR to locate the injected thread within `explorer.exe` and terminate it, then remove the randomized Registry persistence keys.
3. Manually audit and reset the Windows local proxy settings (`inetcpl.cpl` -> LAN settings) to ensure traffic is no longer being routed through the malware.
4. Block all identified Cycbot C2 domains and IP addresses at the enterprise firewall.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the infection is 'just adware'; Cycbot is a full-featured backdoor capable of executing arbitrary commands from the botmaster.
2. Avoid ignoring the network anomalies; the click-fraud traffic consumes significant bandwidth and degrades network performance.

References & External Analysis

• Search "cycbot" on VirusTotal (External Analysis)
• Search "cycbot" on Any.Run (Sandbox Sandbox)
• Search "cycbot" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Zeleffo
• Pantera
• Inor
• Ditertag
• Foxhiex
• Bonkyhp
• Bertle
• Bhxu

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/cycbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.