What is Conficker Worm?

Conficker Worm

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Windows networks; self-propagating network worm

Source Attribution

Origin: MITRE
Source: MITRE ATT&CK · Microsoft
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: MITRE ATT&CK · Microsoft · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2008-11 discovered Conficker worm first observed
2009-01 exploited Peak global infections
2010-09 updated FBI bounties posted for authors

Quick Answer

Conficker spreads via SMB vulnerability, AutoRun and weak passwords, installing a botnet with rolling domain generation for command and control.

Definition

Conficker exploited the MS08-067 vulnerability to self-propagate across Windows networks, forming one of the largest botnets ever observed.

Overview

Conficker exploited the MS08-067 vulnerability to self-propagate across Windows networks, forming one of the largest botnets ever observed.

Behavior

Self-propagating MS08-067 exploitation
Millions of machines infected
Rolling domain generation algorithm

First Seen

2008-11

Target

Windows networks; self-propagating network worm

Techniques: T1210, T1071, T1482
Campaigns: n/a
Related CVEs: CVE-2008-4250

Malware Intelligence

Family: Conficker Worm

Aliases: Conficker, Downadup

Techniques: T1210, T1071, T1482

Targets: Windows networks; self-propagating network worm

Behavior:

Self-propagating MS08-067 exploitation
Millions of machines infected
Rolling domain generation algorithm

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Conficker Worm. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Conficker Worm?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.