History and stories
Mydoom: still the fastest-spreading email worm
The message looked like a bounced email nobody needed to read. People opened the attachment anyway.
1 min readStory
The short version
In January 2004, an email that looked like a delivery error spread faster than any email worm before or since.
The story
On January 26, 2004, emails started appearing with subjects like “Mail Delivery System” or “Test” and a short line saying the message could not be displayed. An attachment was included, supposedly holding the original message.
Opening the attachment installed Mydoom. It sent copies of itself to addresses it found on the computer and opened a hidden back door, letting the attacker use the machine to send spam. It became the fastest-spreading email worm on record, a record it still holds.
Some versions also flooded particular company websites with traffic. The author has never been identified. A line in the code read “Andy; I’m just doing my job, nothing personal, sorry,” which led many to believe the author was paid.
Why it mattered
Mydoom showed that worms had become a business. Infected computers were rented out to send junk mail and launch attacks.
The lesson today
Fake delivery failures, fake voicemails and fake “document could not be displayed” notices still work, because they look like boring system messages. If you did not send the email that bounced, you do not need to open the attachment.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.