Description
Sonbokli is a worm that spreads through USB drives and network shares, infecting additional systems as users share storage and files. Its propagation requires no email delivery, so infections persist in environments with shared drives and unrestricted removable media, and it can carry additional payloads as it spreads. Detections under this name call for checking every connected storage device and shared folder for the worm.
Stats
- First seen
- January 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Android.Trojan.Sonbokli |
| ByteCode-MSIL.Trojan.Sonbokli |
| Document-HTML.Trojan.Sonbokli |
| Document-Office.Trojan.Sonbokli |
| Document-PDF.Trojan.Sonbokli |
| Document-RTF.Trojan.Sonbokli |
| Linux.Trojan.Sonbokli |
| Script-AutoIt.Trojan.Sonbokli |
| Script-JS.Trojan.Sonbokli |
| Script-Macro.Trojan.Sonbokli |