LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0608: Conficker

Conficker is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread.[1] In 2016, a variant of Conficker made its way on computers and removable disk drives belonging to a nuclear power plant.[2]

EnterpriseS0608MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Conficker matters because it is an older Windows worm tied to MS08-067 that demonstrates how unpatched systems, SMB exposure, and removable media can keep legacy malware relevant long after first discovery. The ATT&CK relationships also connect it to availability and productivity impacts in ICS contexts, including a reported 2016 case involving computers and removable drives at a nuclear power plant.

Executive priority

Treat this as a resilience and hygiene test: can the organization prove legacy Windows vulnerabilities are remediated, SMB/admin share exposure is controlled, removable media use is governed, and critical operations are segmented from routine IT infection paths? For leaders, the value is not panic about Conficker specifically, but evidence that old wormable conditions cannot still disrupt operations, audits, incident response, or cyber-physical environments.

Technical view

For SOC, IR, and detection engineering teams, validate coverage around the supplied Windows behaviors and related techniques: SMB/Windows admin shares, exploitation of remote services, network service discovery, removable media replication, registry modification, service creation or modification, Run keys/startup persistence, ingress tool transfer, DGA-like command-and-control, and attempts to impair recovery or security tooling. Because ATT&CK provides no official detection text for this malware object, detections should be built from the related techniques and confirmed against local Windows, network, DNS, removable media, and endpoint telemetry.

Likely telemetry

  • Windows endpoint process, service, and registry events
  • SMB/admin share access logs and lateral movement evidence
  • Windows security events for remote logon and administrative share use
  • Network flow data showing scanning or service discovery behavior
  • DNS telemetry suitable for identifying unusual or algorithmic domain lookups

Detection direction

  • Confirm whether Windows hosts still expose SMB paths that could support lateral movement through admin shares or remote service exploitation.
  • Tune for combinations of scanning, SMB access, remote execution, registry modification, and Windows service persistence rather than relying on a single indicator.
  • Validate visibility for removable media use, especially in segmented, operational, or air-gapped environments where network controls may not see the initial transfer.
  • Use DNS monitoring to look for suspicious high-volume or patterned domain lookups consistent with DGA-related command-and-control behavior, while accounting for false positives from legitimate dynamic services.
  • Review alerting for attempts to disable, modify, or degrade security tools and recovery mechanisms, since related techniques include defense impairment and inhibit system recovery.

Mitigation priorities

  • Prioritize verification that Windows systems are patched against the MS08-067 vulnerability referenced in the official description, especially legacy and operational technology-adjacent assets.
  • Restrict and monitor SMB/admin share access, remote administration paths, and unnecessary network service exposure.
  • Enforce removable media controls, scanning, and approval workflows for environments with critical operations or disconnected systems.
  • Harden Windows persistence locations such as services, Registry Run keys, and startup folders with monitoring and change control.
  • Maintain segmentation between enterprise IT and critical operational environments to reduce the chance that IT malware creates ICS availability or productivity consequences.
Additional notes and limits

This take is based on the supplied ATT&CK malware object for Conficker, its official description, external references, and listed relationships. The most decision-relevant context is the combination of Windows worm behavior, MS08-067, removable media replication, SMB/lateral movement, persistence, command-and-control, and ICS availability/productivity relationships.

ATT&CK provides no official detection text, no tactics directly on the malware object, and no aliases in the supplied object fields. Some related technique descriptions are generic or truncated, and several related technique platform lists extend beyond Windows; the malware platform supplied here is Windows. Local asset inventory, patch state, segmentation design, and telemetry availability are required to assess actual exposure or coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Conficker

Conficker is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread.[1] In 2016, a variant of Conficker made its way on computers and removable disk drives belonging to a nuclear power plant.[2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

13 rows
DomainIDNameRelationship / procedure
EnterpriseT1112Modify Registry

Conficker adds keys to the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and various other Registry locations.[1][3]

EnterpriseT1543.003Windows ServiceSub-technique

Conficker copies itself into the %systemroot%\system32 directory and registers as a service.[1]

EnterpriseT1124System Time Discovery

Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.[1][3]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

Conficker variants spread through NetBIOS share propagation.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Conficker adds Registry Run keys to establish persistence.[3]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.[1][3]

EnterpriseT1210Exploitation of Remote Services

Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.[1]

EnterpriseT1027Obfuscated Files or Information

Conficker has obfuscated its code to prevent its removal from host machines.[3]

EnterpriseT1046Network Service Discovery

Conficker scans for other machines to infect.[1]

EnterpriseT1685Disable or Modify Tools

Conficker terminates various services related to system security and Windows.[1]

EnterpriseT1490Inhibit System Recovery

Conficker resets system restore points and deletes backup files.[1]

EnterpriseT1091Replication Through Removable Media

Conficker variants used the Windows AUTORUN feature to spread through USB propagation.[1][3]

EnterpriseT1105Ingress Tool Transfer

Conficker downloads an HTTP server to the infected machine.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1021.002: SMB/Windows Admin SharesEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1568.002: Domain Generation AlgorithmsEnterpriseuses · TechniqueT1210: Exploitation of Remote ServicesEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1091: Replication Through Removable MediaEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
c553520e1c1b1110...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlec553520e1c1b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  2. [2]
    Conficker Nuclear Power Plant

    Cimpanu, C. (2016, April 26). Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary. Retrieved February 18, 2021.

    Open source URL
  3. [3]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  4. [4]
    Conficker Nuclear Power Plant

    Cimpanu, C. (2016, April 26). Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary. Retrieved February 18, 2021.

    Open source URL
  5. [5]
    Conficker Nuclear Power Plant

    Cimpanu, C. (2016, April 26). Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary. Retrieved February 18, 2021.

    Open source URL
  6. [6]
    Downadup

    (Citation: SANS Conficker)

  7. [7]
    Downadup

    (Citation: SANS Conficker)

  8. [8]
    Downadup

    (Citation: SANS Conficker)

  9. [9]
    Kido

    (Citation: SANS Conficker)

  10. [10]
    Kido

    (Citation: SANS Conficker)

  11. [11]
    Kido

    (Citation: SANS Conficker)

  12. [12]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  13. [13]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  14. [14]
    mitre-attackS0608
    Open source URL
  15. [15]
    mitre-attackS0608
    Open source URL
  16. [16]
    mitre-attackS0608
    Open source URL
  17. [17]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  18. [18]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  19. [19]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  20. [20]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  21. [21]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  22. [22]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  23. [23]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  24. [24]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  25. [25]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  26. [26]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  27. [27]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  28. [28]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  29. [29]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  30. [30]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  31. [31]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  32. [32]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  33. [33]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  34. [34]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  35. [35]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  36. [36]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  37. [37]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  38. [38]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  39. [39]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  40. [40]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  41. [41]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  42. [42]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  43. [43]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
  44. [44]
    Trend Micro Conficker

    Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.

    Open source URL
  45. [45]
    SANS Conficker

    Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use