Dorkbot is a family of malware worms that spreads through instant messaging, USB drives, websites or social media channels like Facebook.
Contents
Functionality
Dorkbot’s backdoor functionality allows a remote attacker to exploit infected system. According to an analysis by Microsoft, a remote attacker may be able to:
Impact
A system infected with Dorkbot may be used to send spam, participate in DDoS attacks, or harvest users' credentials for online services, including banking services.
Prevalence
Between May and December of 2015, the Microsoft Malware Protection Center detected Dorkbot on an average of 100,000 infected machines each month.
History
On December 7th, 2015 the FBI and Microsoft in a joint task forced took down the Dorkbot Botnet.
Remediation
In 2015, the U.S. Department of Homeland Security advised the following action to remediate Dorkbot infections: