Academy
Historical caseWindowsWorm, botnet agent
DR-NOS-04

Palevo (Mariposa botnet)

In 2009, MSN Messenger users received short messages such as “is this you on pic?” with a photo link from their friends. The link was not a photo but the Palevo worm. The Mariposa botnet built with Palevo controlled around 12.7 million computers in more than 190 countries when it was taken down in December 2009.

When it was shut down, the botnet held around 12.7 million computers, including large companies, banks and public institutions.

MSN MessengerPalevoMariposabotnet2009

Activity map

Trend Micro Threat Encyclopedia

Activity mapMSN MessengerA friend on your listEXEPicture-like file.exePalevoWormContact listSigned-in sessionSame messageTo every contactUSB driveCopied overMariposa botnetRemote commandsCredentialsBrowser and forms
Executable payloadFile
Malicious payloadPalevo · Worm

Palevo settles into the computer. It registers itself to run again at every startup.

First seen
2008–2009
Delivery
MSN Messenger, USB drives, P2P
Region
Worldwide, more than 190 countries
Type
Worm, botnet agent
01

Overview

The user receives a short message and a link from a friend in their list: “is this you on pic?”. The link downloads a file named like an image; running it installs Palevo. Palevo sends the same message to all contacts through the user’s Messenger and copies itself to USB drives. The computer joins the botnet: credentials are collected from the browser and forms, extra payloads are downloaded, and the machine is used in attacks.

Also known as: Rimecud, Pilleuz

02

Timeline

  1. 2009Palevo variants spreading through MSN Messenger, removable drives and P2P were reported. Bitdefender HotForSecurity
  2. 23 December 2009The Mariposa botnet’s command servers were shut down in a coordinated action by an international working group. Wikipedia
  3. February–March 2010Three people believed to run the botnet were arrested in Spain. Wikipedia
  4. July 2010The person believed to have written Palevo was arrested in Slovenia. Wikipedia
03

Infection chain

  1. 1

    A message arrives on Messenger from a friend on your list.

    • It is short and familiar: “is this you on pic?” and a link.
  2. 2

    The link downloads a file that looks like a picture.

    • No picture opens; Palevo is installed in the background.
  3. 3

    Palevo settles into the computer.

    • It registers itself to run again at every startup.
  4. 4

    The Messenger contact list is read.

    • The session is already signed in, so no password is needed.
  5. 5

    The same message goes to every contact in your name.

    • Friends open it because it comes from you; that is how the chain grows.
  6. 6

    It also copies itself to every USB drive that is plugged in.

    • When the drive is used on another computer, the infection continues there.
  7. 7

    The computer joins the Mariposa botnet.

    • It takes commands from remote servers, downloads more software and is used in attacks.
  8. 8

    Credentials are collected from the browser and web forms.

    • Banking and email logins go to the attackers.
04

How it came to light

Mariposa was uncovered by a security firm (Defence Intelligence) in May 2009; a working group formed with Spain’s Guardia Civil, the FBI and Panda Security analysed the command servers and shut them down in December 2009. One of the operators logging into the panel from his home connection made identification possible.

05

Who was affected

When it was shut down, the botnet held around 12.7 million computers, including large companies, banks and public institutions. The data collected included banking and email credentials.

06

Relevance today

The “is this you?” lure lives on in WhatsApp, Telegram, Discord and Instagram messages. Hijacked accounts still send links to friends; the difference is that the link now ends with an infostealer collecting passwords, cookies and crypto wallets.

07

Sources

  1. 1WORM_PALEVO · Trend Micro Threat Encyclopedia
  2. 2“Worm week at Bitdefender” (2009) · Bitdefender HotForSecurity
  3. 3“Aggressiver Wurm verbreitet sich über Messenger” · WinFuture
  4. 4“Mariposa botnet” · Wikipedia
  5. 5“Another botnet gets dismantled, but this time with arrests” (2010) · Dark Reading
Article details
Category
Case analysis
Type
Worm, botnet agent
First seen
2008–2009
Tags
  • MSN Messenger
  • Palevo
  • Mariposa
  • botnet
  • 2009

More cases

August 2008Social network worm, botnetKoobfaceIn 2008, Facebook and MySpace users received a video link from their friends. The video would not play and said a Flash Player update was required. The download was Koobface: a worm that used the hijacked account to send the same message to the whole friend list, collected credentials and sold fake antivirus. The group behind it was publicly identified only in 2012.Read more Mid-2000sPassword stealer (a forerunner of infostealers)LdPinch (Pinch)In the mid-2000s, ICQ was the most widely used instant messenger on the Russian-speaking internet, and short, memorable ICQ numbers (UINs) were worth money. In May 2008, Kaspersky reported that ICQ number theft had been going on for years and was carried out mainly with the LdPinch family. LdPinch collected not only ICQ but also email, FTP and gaming accounts.Read more Around 2007; epidemic in January 2010Screen-locking ransomwareWinlockIn the winter of 2009–2010, the screens of millions of computers in Russia were locked by a window demanding an SMS to a premium short number to unlock them. Dr.Web announced January 2010 as a Trojan.Winlock epidemic. In September 2010, Russian police detained 10 people believed to have earned 16 million dollars from the scheme.Read more
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans