Academy

Malware families, threat intelligence terms and cases that left their mark.

52malware families
73terms
9cases

Years infostealer families emerged39 families with a known first-seen dateActiveDecliningInactive

Case archive

Malware outbreaks that left their mark. Each case comes with a video, a step-by-step infection map and its sources.

3 November 2026Investment fraudOperation against fake investment platformsOn 3 November 2026, a simultaneous operation in seven countries targeted the infrastructure of a company suspected of supplying ready-made fake trading sites to criminal groups. More than 100 servers were seized, 17 locations were searched and 7 suspects were arrested.

29 October 2026Crypto exchange breachBinance hot wallet breachOn the evening of 29 October 2026, assets worth about $6.3 billion were taken out of Binance’s hot wallets on ten blockchains. Most of the money was gone within about 20 minutes. We examined the drain transactions, the EIP-7702 technique, the race to freeze and where the money sits today using public blockchain data.

4 May 2000Email wormILOVEYOUOn 4 May 2000, an email with the subject line “ILOVEYOU” started in Manila and reached Hong Kong, Europe and the United States the same day. The attached VBScript sent itself to everyone in the Outlook address book, overwrote files on local disks and network shares, and downloaded a password-stealing program.

11–12 February 2001Email worm (VBScript)Anna KournikovaIn February 2001, an email attachment claiming to be a photo of tennis player Anna Kournikova flooded mail servers across Europe and North America within hours. The worm had been made with a “worm generator” kit that required no coding skills. Its damage stayed far below ILOVEYOU, but it spread almost as fast.

2008–2009Worm, botnet agentPalevo (Mariposa botnet)In 2009, MSN Messenger users received short messages such as “is this you on pic?” with a photo link from their friends. The link was not a photo but the Palevo worm. The Mariposa botnet built with Palevo controlled around 12.7 million computers in more than 190 countries when it was taken down in December 2009.

August 2008Social network worm, botnetKoobfaceIn 2008, Facebook and MySpace users received a video link from their friends. The video would not play and said a Flash Player update was required. The download was Koobface: a worm that used the hijacked account to send the same message to the whole friend list, collected credentials and sold fake antivirus. The group behind it was publicly identified only in 2012.

Mid-2000sPassword stealer (a forerunner of infostealers)LdPinch (Pinch)In the mid-2000s, ICQ was the most widely used instant messenger on the Russian-speaking internet, and short, memorable ICQ numbers (UINs) were worth money. In May 2008, Kaspersky reported that ICQ number theft had been going on for years and was carried out mainly with the LdPinch family. LdPinch collected not only ICQ but also email, FTP and gaming accounts.

Around 2007; epidemic in January 2010Screen-locking ransomwareWinlockIn the winter of 2009–2010, the screens of millions of computers in Russia were locked by a window demanding an SMS to a premium short number to unlock them. Dr.Web announced January 2010 as a Trojan.Winlock epidemic. In September 2010, Russian police detained 10 people believed to have earned 16 million dollars from the scheme.

2008Fake notification, social engineeringAyça_22In 2008–2009, a box resembling an MSN Messenger notification appeared in the lower-right corner of many Turkish websites: “Ayça_22 is now on camera.” It was not a message but an advertisement. It sent those who clicked to webcam sites; according to user accounts, some of them ran into malware.

Malware families

Technical profiles of infostealer families, the applications they target and their MITRE ATT&CK mappings. Ranked by Dark Radar infection records.

All 52 families

Terms

Short definitions of concepts used in infostealer and threat intelligence work.

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z