Conficker

MITRE ATT&CK: S0608 View on attack.mitre.org

Aliases: Kido, Downadup, downadup, traffic converter, Conficker

First seen
2008-10-01 00:00:00
Malware type
worm, botnet
Family
Malware family
Operating systems
windows
Related IoCs
3978 (3248 malicious)
Last IoC activity
2026-10-16 09:16:47
Profile updated
2026-07-07 14:49:56

Targeted industries: energy-and-utilities government-and-public-sector

Context

Conficker is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread. In 2016, a variant of Conficker made its way on computers and removable disk drives belonging to a nuclear power plant.

Recent IoC activity

3,248 malicious indicators in Maltiverse are attributed to Conficker (S0608). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname kbeia.ws 2026-10-17 1
hostname rvmafs.ws 2026-10-17 1
hostname bmcrb.ws 2026-10-17 1
hostname kjkhy.ws 2026-10-17 1
hostname tjfji.ws 2026-10-16 1
hostname pertczxzzhg.ws 2026-10-16 1
hostname drwrug.ws 2026-10-14 2
hostname ixrpszmny.ws 2026-10-13 1
file sample 651217b0cf16f94cfe14749c766fbb784f5339af1e915acc6cca134bab0257f7 2026-10-13 1
file sample jaffacakes118_Net-Worm.Win32.Kido.ih.52ec92f5cc9eaf073c4da2b866595365 2026-10-13 1
file sample jaffacakes118_Net-Worm.Win32.Kido.ih.4f66a24744c276ffa26c9e85ce471b3e 2026-10-13 1
file sample jaffacakes118_Net-Worm.Win32.Kido.ih.4edb0a5af0d6723a1bc26fc581d35eab 2026-10-13 1
hostname bquhcd.ws 2026-10-12 1
hostname aikxmh.ws 2026-10-12 1
hostname feqab.ws 2026-10-11 1
hostname hglvp.ws 2026-10-11 1
hostname npsnw.ws 2026-10-11 1
hostname wbespp.ws 2026-10-10 1
hostname vnjiimxtw.ws 2026-10-10 1
hostname dgqzpf.ws 2026-10-10 1

Detection coverage

  • 1 YARA rules
  • 550 Sigma rules

Malware & tools used

  • Modify Registry (attack-pattern)
  • Windows Service (attack-pattern)
  • System Time Discovery (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)
  • Exploitation of Remote Services (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Network Service Discovery (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Inhibit System Recovery (attack-pattern)
  • Replication Through Removable Media (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Loss of Productivity and Revenue (attack-pattern)
  • Replication Through Removable Media (attack-pattern)
  • Loss of Availability (attack-pattern)

Detection rules

  • MALPEDIA_Win_Conficker_Auto (yara-rule)

Related threat objects

  • Conficker (infrastructure)

Reports & references

  • malpedia.caad.fkie.fraunhofer.de — Win.Conficker (report)
  • csl.sri.com — Index (report)
  • github.com — Conficker.Md (report)
  • kaspersky.com — 2009 Kaspersky Lab Analyses New Version Of Kido Conficker (report)
  • sophos.com — Confickeranalysis (report)
  • github.com — Cnfckr (report)
  • minitool.com — Conficker Worm (report)
  • contagiodump.blogspot.com — Win32Conficker (report)
  • MITRE ATT&CK — S0608 (report)
  • news.softpedia.com — On Chernobyl S 30Th Anniversary Malware Shuts Down German Nuclear Power Plant 503429.Shtml (report)
  • web.archive.org — Conficker Worm (report)
  • redcanary.com — Intelligence Insights January 2022 (report)
  • web.archive.org — Blackhat Eu 2010 Carrera Silberman State Of Malware Slides (report)

External references