Derp.ca

Conficker

Conficker, also known as Downadup and Kido, is a Windows network worm first identified in 2008 that caused millions of infections globally, particularly affecting unpatched and legacy Windows environments.

Conficker

Family profile

Conficker, also known as Downadup and Kido, is a Windows network worm first identified in 2008 that caused millions of infections globally, particularly affecting unpatched and legacy Windows environments. Its principal propagation vector was exploitation of MS08-067, a remote code-execution vulnerability in the Windows Server service reachable over SMB/RPC. Variants also spread by brute-forcing weak credentials on SMB shares and by infecting removable media, enabling broad autonomous propagation within enterprise networks.

Conficker establishes persistence through Windows service and autorun mechanisms, modifies system and network settings, and can inject into Windows processes. It employs polymorphism, obfuscation, anti-analysis, anti-sandbox, and anti-virtualization measures, and has interfered with security products, update-related services, and security-related DNS resolution. The worm uses a domain-generation algorithm for command-and-control resilience; some variants additionally used peer-to-peer communications to receive updates and download further malware. Conficker is not reliably attributable to a publicly identified threat actor.

Capabilities

  • Brute Force
  • Defense Evasion
  • Lateral Movement
  • Persistence
  • Scanning

Samples

Recent samples

4 sandbox samples in the Derp library, newest 4 shown

5ee22794320d8e1e0310f3dcfa58b65e6d9293d9e012bfad4231cd6ae77306e8
Analysed Oct 6, 2026Triage report
cff54b92ce353e56fda1c6df77950979c96e06e22b77e99ba39b6c8a36d7a53d
Analysed Oct 6, 2026Triage report
cf82e064ba006444c8a8227da4ae3e688facbcaadf88f2da938726aa24f206d5
Analysed Oct 6, 2026Triage report
9af727864495933556e45bfaa3a550b0436f7b66f6efaf5cd8400137a0b100f7
Analysed Oct 4, 2026Triage report

Exploited software

Vulnerabilities linked to Conficker

1 CVEs
CVE-2008-4250 MS08-067 Windows Server Service Remote Code Execution

MITRE ATT&CK

Conficker in ATT&CK

47 distinct techniques

Techniques

47 techniques
T1490 Inhibit System Recovery T1210 Exploitation of Remote Services T1091 Replication Through Removable Media T1027 Obfuscated Files or Information T1568.002 Domain Generation Algorithms T1046 Network Service Discovery T1685 Disable or Modify Tools T1105 Ingress Tool Transfer T1112 Modify Registry T1124 System Time Discovery T1543.003 Windows Service T1021.002 SMB/Windows Admin Shares T1547.001 Registry Run Keys / Startup Folder T1027.014 Polymorphic Code T1055 Process Injection T1568 Dynamic Resolution T1110 Brute Force T1218.011 Rundll32 T1070.004 File Deletion T1068 Exploitation for Privilege Escalation T1497 Virtualization/Sandbox Evasion T1036 Masquerading T1095 Non-Application Layer Protocol T1564.004 NTFS File Attributes T1190 Exploit Public-Facing Application T1584.005 Botnet T1568.001 Fast Flux DNS T1583.005 Botnet T1203 Exploitation for Client Execution T1480.002 Mutual Exclusion T1071.001 Web Protocols T1071 Application Layer Protocol T1498 Network Denial of Service T1598 Phishing for Information T1057 Process Discovery T1056.001 Keylogging T1078 Valid Accounts T1583.001 Domains T1499 Endpoint Denial of Service T1140 Deobfuscate/Decode Files or Information T1070 Indicator Removal T1573 Encrypted Channel T1649 Steal or Forge Authentication Certificates T1213 Data from Information Repositories T1003 OS Credential Dumping T1489 Service Stop T1566.001 Spearphishing Attachment

Reporting

Research mentioning Conficker

Aug 11
Cvefeed High Severity

CVE-2026-62781 - RPC Runtime Library Remote Code Execution Vulnerability

Microsoft disclosed CVE-2026-62781, a high-severity remote code execution flaw in the Windows RPC Runtime Library that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as CWE-122 and scored CVSS 8.1, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to T1210, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.
May 14
Splunk Research

Detection: Splunk RCE via External Lookup Copybuckets | Splunk Security Content