The Ghost in the Subnet: Hunting Conficker in 2018
Category: Incident Response / Malware Analysis / Sysadmin War Stories
Tags: Conficker, MS08-067, Incident Response, Wireshark, Nmap, Windows Server 2003
The Hook: A Decade-Old Ghost
Every sysadmin has a gallery of legacy horrors, but few expected to fight the poster child of late-2000s self-propagating worms a full decade after its release. Yet in August 2018, an MSP war room found itself trapped in an active containment battle against Win32/Conficker (also known as Downadup).
What made this incident particularly dangerous wasn't just the worm's resilience—it was the environment. The client was a commercial print facility. Interspersed on the same flat local network as the office workstations and file servers were specialized printing presses: multimillion-dollar industrial machines controlled by vintage PC towers running Windows NT 4.0, Windows 2000, and Windows Server 2003.
These press controllers utilized legacy SCSI interfaces and proprietary ISA/PCI controller boards. They could not be upgraded, could not be patched against modern threats, and could not be replaced without scrapping entire press lines. I had previously been sent on-site with legacy drive imaging equipment just to pull raw block-level sector backups of their IDE drives so a disk failure wouldn't sink the factory floor.
If Conficker tore loose among those unpatched controllers and triggered memory crashes or kernel panics, it wouldn't just knock out email—it would physically halt printing operations.
Phase 1: The First Spark (July 31 – August 2)
The incident started on the morning of July 31, 2018, at approximately 11:40 AM with an automated warning from Cisco OpenDNS (now Cisco Umbrella):
"3 botnet queries to 1 domains contained from [Workstation] since last update. This indicates a potential malware infection."
Figure 1: The July 31, 2018, OpenDNS alert that signaled the initial infection.
A technician grabbed the ticket, retrieved the user's contact information, and threw the standard cleanup gauntlet at the PC: SuperAntiSpyware, Malwarebytes, and the resident antivirus. The tools found malicious indicators, scrubbed them, and were uninstalled. The PC showed clean. The ticket was closed.
Two days later, on August 2, the worm surfaced on a second workstation.
Simultaneously, the remote monitoring platform lit up: automated alerts reported active worm infections spreading across multiple Windows servers. The technician scrambled to clean the second workstation and deploy AV agents across the server fleet. Within hours, the alerts converged on a single diagnosis: Win32/Conficker.
Phase 2: The Whac-A-Mole Trap (August 3 – August 27)
A maintenance window was scheduled for 6:00 PM, preceded by running F-Secure’s standalone Conficker removal tool across the server fleet. The technician also found Microsoft Knowledge Base article KB962007, which detailed specific Group Policy Objects (GPOs) required to suppress the worm's propagation.
Unsure of the operational side effects, the technician escalated the article. Leadership initially declined to apply the GPO, fearing the restrictions would disrupt core network services and line-of-business software.
The next morning, August 3, the servers were re-infected.
Seeing the loop continue, management reversed course. The client was advised of the operational necessity, approved the policy changes, and the GPO was linked. But Conficker had already established deep roots:
The Legacy Anchor: One core server ran Windows Server 2003 R2 SP2. Modern endpoint protection struggled to install on the deprecated platform, requiring multiple days of vendor support escalation and custom legacy installation bundles.
The Log Loop: For three weeks, the cycle repeated: AV vendor logs collected, diagnostic bundles submitted, reboots scheduled, updates pushed, and new infection alerts popping up within days.
The Lateral Drop via Cloud Sync: On August 30, a new ticket reported a workstation infected via Dropbox. A remote employee utilizing a single Dropbox account across both home and office PCs had bridged the worm across physical perimeters via synced folders.
The team was treating symptoms on endpoints while the worm continued to freely traverse the wire.
Phase 3: The Packet Forensic Breakdown
I stepped in to assist on August 29. By this point, remediation fatigue had set in. Conficker was not simply dropping files; it was weaponizing multiple propagation channels simultaneously:
Remote exploitation over port 445 via the MS08-067 RPC buffer overflow (NetPathCanonicalize).
Administrative share brute-forcing (IPC$, ADMIN$, C$) using compromised domain and local accounts.
Automated task creation via the Task Scheduler RPC interface (ATSVC).
To verify exactly what Conficker was executing on the wire, we captured live lateral traffic on the subnet (192.168.0.0/24).
Download the Sanitized Packet Capture:
Download Attack_anon.pcapng (All client names, NetBIOS hostnames, and domain authentications have been completely sanitized).
Artifact 1: Authenticated SMB Infiltration & Payload Drop
In the capture between the infected staging box (192.168.0.100 / SRV-ATTACK-01) and the target server (192.168.0.62 / PRINT-SRV01), we see the complete administrative share attack vector:
Figure 2: Conficker authenticating over SMB, testing for prior presence, and streaming its binary payload.
Key Frames Decoded:
Frames 8–11 (Credential Reuse): The attacking host initiates NTLMSSP authentication. In Frame 10, it passes the local Administrator credential. In Frame 11, the target returns Session Setup AndX Response—access granted. Because identical local administrator passwords existed across systems, Conficker walked straight through the front door.
Frames 12–15 (Admin Share Access): It maps \\PRINT-SRV01\IPC$ and immediately connects to the administrative share: \\PRINT-SRV01\ADMIN$ (the remote %SystemRoot% directory).
Frames 18–19 (Reconnaissance): It queries for \System32\ozspddh.dll. Conficker generates pseudo-random 5- to 8-character filenames to hide its payload. In Frame 19, the target returns STATUS_NO_SUCH_FILE, signaling that this specific host is not yet hosting that file.
Frames 20–27 (Staged Allocation): In Frame 20, it issues an NT Create AndX Request to write \System32\ozspddh.p with file handle 0x4000. Conficker drops the payload using a .p extension instead of .dll to avoid real-time file-extension filters. In Frame 24, it issues a write offset at byte 169531, pre-allocating the ~165 KB footprint on disk.
Frames 28–31 (Payload Streaming): The connection shifts to full TCP PDU reassembly (Len=1460), pumping the raw packed worm binary across the wire.
Artifact 2: Exploiting the Task Scheduler for Execution
Once the file was staged on the filesystem, the worm needed a mechanism to run it with elevated privileges without interactive user intervention:
Figure 3: Conficker attempting to register a scheduled task via the DCE/RPC ATSVC interface.
Key Frames Decoded:
Frames 213–216 (Binding to the Scheduler): In Frame 213, the attacker opens an IPC pipe request to Path: \atsvc. In Frame 215, it binds to DCE/RPC interface ATSVC V1.0 (UUID: 1ff70682-0a51-30e1-83d2-d7900381e3da), which controls the legacy Windows At.exe service.
Frames 217–218 (Weaponized Task Registration): The attacking host sends an ATSVC JobAdd request. This attempts to configure a recurring scheduled task running under NT AUTHORITY\SYSTEM to invoke rundll32.exe ozspddh.p,<ordinal> or launch the dropped binary.
In Frame 218, the target returns an error status (0x00000032), denying task creation. The attacker tears down the SMB tree, logs off, and moves on to the next IP.
Phase 4: The Tactical Pivot & Resolution
Treating endpoints in isolation had failed for a month because unpatched hosts were acting as persistent broadcast reservoirs, instantly re-infecting cleaned machines. We changed tactics:
1. Hard Execution Containment via GPO
I deployed a Software Restriction Policy (SRP) via Group Policy Object that barred all executable launches originating from user-writable directories:
%AppData%
%LocalAppData%
%Temp%
Even if Conficker managed to drop staging files across an open share or through synced storage, the binaries were blocked from loading into memory.
2. Identifying the Rendezvous Pulse
Analyzing the AV logs across six infected servers revealed a consistent pattern. While the generated filename inside C:\Windows\System32\ differed from server to server (e.g., ozspddh.p), each individual host reused its assigned string. Furthermore, scheduled task attempts fired consistently every 3 to 4 hours. The rendezvous heartbeat was identifiable.
3. Offensive Network Reconnaissance with Nmap
Instead of waiting for antivirus agents to register detections, we treated the entire broadcast subnet as an active threat surface. I connected to a central server, installed Nmap, and initiated targeted scans across the subnet using Nmap’s Network Scripting Engine (NSE):
nmap -p 445 --script smb-vuln-ms08-067,smb-vuln-conficker 192.168.0.0/24
The scan cut through the ambiguity: two specific servers returned positive for active MS08-067 vulnerabilities and live Conficker processes.
These two machines were unpatched, missing the decade-old security hotfix. Every time endpoint AV cleaned a neighboring server or workstation, these two boxes re-exploited them over port 445 within minutes of the system completing a reboot.
Once identified, the remediation was straightforward:
The two vulnerable hosts were isolated from the network.
The legacy MS08-067 hotfix was manually installed, and the dropped DLLs were excised.
Local administrator passwords were randomized across all systems to break the SMB credential replay loop.
The press controller network was placed behind strict network isolation to ensure legacy NT 4.0/2000 boxes never shared an unrestricted broadcast domain with general office devices again.
The infection ceased immediately.
Lessons from the Trenches
You cannot clean your way out of a self-propagating worm: Running local cleaners on endpoints while leaving transport layers (SMB/RPC) open is like baling water out of a boat without plugging the hull.
Network reconnaissance outpaces endpoint agents: Antivirus logs tell you where a payload landed; network-layer vulnerability scans tell you where the active reservoir lives.
Legacy machinery requires network segmentation: In industrial, printing, and healthcare settings, vintage operating systems often cannot be patched or replaced. If they cannot protect themselves, they must be air-gapped or firewalled off from standard workstation traffic.
Local Administrator credential reuse is a fatal shortcut: Conficker’s ability to sweep the subnet was facilitated by identical administrative credentials shared across endpoints.