Academy
Historical caseWindowsSocial network worm, botnet
DR-NOS-05

Koobface

In 2008, Facebook and MySpace users received a video link from their friends. The video would not play and said a Flash Player update was required. The download was Koobface: a worm that used the hijacked account to send the same message to the whole friend list, collected credentials and sold fake antivirus. The group behind it was publicly identified only in 2012.

Estimates of the botnet’s size vary between sources; the group’s annual revenue was reported to be in the millions of dollars.

KoobfaceFacebooksocial networkbotnet2008

Activity map

Wikipedia

Activity mapFacebookMessage from a friendVideo pageYouTube look-alikeEXE“Flash update”FakeKoobfaceWormFriend listSigned-in sessionSame messageTo every friendCredentialsSaved passwordsSearch hijackingAd clicksEXEFake antivirusAsks for payment
Executable payloadFile
Malicious payloadKoobface · Worm

Koobface settles into the computer. It uses the social network session left open in the browser.

First seen
August 2008
Delivery
Facebook, MySpace, Twitter messages
Region
Worldwide
Type
Social network worm, botnet
01

Overview

The user receives a message from a friend: “You look so funny on our new video” and a link. The link opens a YouTube-like page; the video does not play and asks for a Flash Player update. The download is Koobface; it uses the user’s open social network session to send the same message to every friend. The computer joins the botnet; credentials are collected, search results are hijacked and fake antivirus is sold.

Also known as: Net-Worm.Win32.Koobface

02

Timeline

  1. August 2008Kaspersky reported two worm variants targeting MySpace and Facebook. Neowin
  2. December 2008“You look so funny on our new video” messages kept spreading on Facebook. TechCrunch
  3. 2009New versions spread to Twitter and other social networks; the lures diversified. Wikipedia
  4. January 2012Facebook and researchers publicly named five suspects believed to live in St. Petersburg; the main server went offline afterwards. SecurityWeek
03

Infection chain

  1. 1

    A message arrives on Facebook from one of your friends.

    • “You look so funny on our new video” and a link.
  2. 2

    The link opens a page that looks like YouTube.

    • The video does not play; it says a “Flash Player update” is needed.
  3. 3

    The file downloaded as an update is Koobface.

    • After the install, there is still no video on the page.
  4. 4

    Koobface settles into the computer.

    • It uses the social network session left open in the browser.
  5. 5

    The friend list is read.

    • Friends on Facebook, MySpace and other networks are queued.
  6. 6

    The same message goes to every friend in your name.

    • Friends open the link because it comes from someone they know.
  7. 7

    Saved credentials are collected.

    • Logins for social networks, email and other accounts go to the attackers.
  8. 8

    Search results are redirected to other sites.

    • Every click turns into ad revenue for the attackers.
  9. 9

    A fake antivirus appears on screen.

    • It lists threats that are not on the computer and asks for payment to remove them.
04

How it came to light

Koobface became known through security vendor detections in 2008; Facebook spent years cleaning accounts and blocking links. The group was identified through researchers’ inferences from the group’s own social media posts and server records. No public court case against the suspects has been reported.

05

Who was affected

Estimates of the botnet’s size vary between sources; the group’s annual revenue was reported to be in the millions of dollars. The main impact was showing at scale that social networks could serve as a delivery channel.

06

Relevance today

The “video won’t play, update required” pattern continues with fake browser updates and fake CAPTCHA pages. Hijacked social media accounts remain the most effective delivery channel: the recipient believes the link came from a friend, not a stranger.

07

Sources

  1. 1“Koobface” · Wikipedia
  2. 2“Koobface virus still making the rounds on Facebook” (2008) · TechCrunch
  3. 3“Kaspersky Lab detects new worms attacking MySpace and Facebook” (2008) · Neowin
  4. 4“Facebook unmasks reputed Koobface gang members” (2012) · SecurityWeek
  5. 5“Koobface malware ring taken offline” (2012) · Redmond Magazine
Article details
Category
Case analysis
Type
Social network worm, botnet
First seen
August 2008
Tags
  • Koobface
  • Facebook
  • social network
  • botnet
  • 2008

More cases

Mid-2000sPassword stealer (a forerunner of infostealers)LdPinch (Pinch)In the mid-2000s, ICQ was the most widely used instant messenger on the Russian-speaking internet, and short, memorable ICQ numbers (UINs) were worth money. In May 2008, Kaspersky reported that ICQ number theft had been going on for years and was carried out mainly with the LdPinch family. LdPinch collected not only ICQ but also email, FTP and gaming accounts.Read more Around 2007; epidemic in January 2010Screen-locking ransomwareWinlockIn the winter of 2009–2010, the screens of millions of computers in Russia were locked by a window demanding an SMS to a premium short number to unlock them. Dr.Web announced January 2010 as a Trojan.Winlock epidemic. In September 2010, Russian police detained 10 people believed to have earned 16 million dollars from the scheme.Read more 2008Fake notification, social engineeringAyça_22In 2008–2009, a box resembling an MSN Messenger notification appeared in the lower-right corner of many Turkish websites: “Ayça_22 is now on camera.” It was not a message but an advertisement. It sent those who clicked to webcam sites; according to user accounts, some of them ran into malware.Read more

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

View productCompare plans