H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Conficker](https://attack.mitre.org/software/S0608) is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread.(Citation: SANS Conficker) In 2016, a variant of [Conficker](https://attack.mitre.org/software/S0608) made its way on computers and removable disk drives belonging to a nuclear power plant.(Citation: Conficker Nuclear Power Plant)

Labels

malware

13 recorded

Relationships

uses

to Disable or Modify Tools

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

to Modify Registry

Technique

uses

to Network Service Discovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Replication Through Removable Media

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Time Discovery

Technique

uses

to Windows Service

Technique

5 external

References

mitre-attack

S0608

Kido

—

Downadup

—

SANS Conficker

https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm

Conficker Nuclear Power Plant

https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml