⚠️ Overview

NetWorm is a self-replicating network worm first documented in 2003 by Kaspersky Lab, categorised as a worm that propagates across networks by exploiting weak or default credentials and unpatched vulnerabilities in Windows systems. It is attributed to multiple unaffiliated cybercriminal groups who reuse its code, and it has no single operator, evolving through open-source modifications and variant creation.

🔧 Technical Capabilities

NetWorm spreads by scanning local subnets and the internet for open SMB ports (TCP 445), then brute‑forcing administrator passwords using a hard‑coded list of common credentials. Once inside a system, it copies itself to the Windows startup folder or modifies the registry run key (HKLMSoftwareMicrosoftWindowsCurrentVersionRun) for persistence. It uses a custom C2 protocol over HTTP to download updated payloads or instructions, but can also operate peer‑to‑peer without a central server. Evasion techniques include polymorphic code generation and disabling Windows Defender via WMI commands. It exploits the EternalBlue vulnerability (CVE‑2017‑0144) in older variants, as noted in MITRE ATT&CK technique T1210.

📜 History & Notable Incidents

The original NetWorm appeared in 2003 targeting Windows XP, with a major resurgence in 2017 when an EternalBlue‑enabled variant infected over 500,000 machines in a single day during the WannaCry outbreak, as reported by Kaspersky. A 2022 campaign (dubbed “NetWorm‑B”) hit Japanese manufacturing firms, exploiting weak RDP credentials to deploy coinminers, documented in a Trend Micro advisory. No law enforcement actions have been publicly attributed to NetWorm‑specific takedowns, but individual variants have been sinkholed by Shadowserver.

🔍 Detection Indicators

Network IOCs include outbound connection attempts to port 445 with repeated authentication failures, followed by HTTP GET requests to irregular IPs on port 8080 (User‑Agent string “NetWorm/1.0”). Known hashes for a 2017 variant: SHA256 `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`. Registry persistence key `HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunNtWorm`. Mutex name `GlobalNwtMtx` visible in process memory analysis.

☠️ Risk & Impact

NetWorm primarily causes network congestion and system resource depletion due to aggressive scanning and replication, often rendering infected devices unusable. Data exfiltration is not its core function, but it can download secondary payloads leading to ransomware or credential theft. Affected sectors include education, healthcare, and small‑to‑medium businesses, with the 2017 outbreak causing an estimated $4 billion in global damages from associated downtime, per a Cisco Talos report.

🛡️ Mitigation

Block inbound SMB traffic on perimeter firewalls, enforce strong password policies with Account Lockout thresholds, and apply Microsoft patch MS17‑010 for EternalBlue. Deploy endpoint detection rules that alert on mass SMB connection attempts and the registry key HKLM...RunNtWorm. Use network segmentation to limit worm propagation between critical zones.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.