Conficker

Description

Conficker is a computer worm first detected in October 2008 that spread by exploiting the MS08-067 vulnerability in Windows. A variant reached computers and removable disk drives at a nuclear power plant in 2016, which shows how long neglected infections can persist on critical networks.

Stats

First seen: May 2022
Last seen: October 2026

Also known as

DownadupKido

MITRE ATT&CK techniques

13 techniques across 7 tactics.

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information

TA0007 Discovery

T1046Network Service Discovery
T1124System Time Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares
T1091Replication Through Removable Media
T1210Exploitation of Remote Services

TA0011 Command and Control

T1105Ingress Tool Transfer
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms

TA0040 Impact

T1490Inhibit System Recovery

TA0112 Defense Impairment

T1112Modify Registry
T1685Disable or Modify Tools

Alert name variants

Alert Name	Engine
Win32.Worm.Conficker	ATP Sandbox Adv. Heuristics
Win32.Worm.Downadup	ATP Sandbox Adv. Heuristics
Win32.Worm.Downadup.Gen	AV
Win32.Worm.Downadup.H	AV
Win32.Worm.Kido	ATP Sandbox Adv. Heuristics

Related families

QakBot InvisiMole Cobalt Strike PlugX TrickBot