Why a 16-year-old worm still haunts business networks
In November 2008, a worm called Conficker began spreading across Windows networks worldwide. It exploited a critical vulnerability in the Windows Server service (MS08-067), and within months it had infected an estimated 9 to 15 million machines — making it one of the largest botnets ever recorded.
Microsoft released an emergency patch weeks before the first variant appeared. Yet here we are, nearly two decades later, and Conficker is still being detected on hundreds of thousands of systems globally. For European SMBs running legacy infrastructure, this is not a history lesson. It is a live threat.
How Conficker spreads and why it refuses to die
Conficker uses three infection vectors that remain effective wherever outdated systems exist. First, it exploits the MS08-067 buffer overflow vulnerability in Windows XP, Vista, Server 2003, and Server 2008. Second, it spreads through USB drives using the autorun feature. Third, it brute-forces weak administrator passwords on network shares.
Each of these vectors thrives in environments where systems are not regularly updated — and that describes more organisations than most IT managers would like to admit. Fortinet’s threat landscape reports from 2022 to 2024 consistently rank Conficker among the top five most detected botnets worldwide, with hundreds of thousands of detections per reporting period.
Legacy systems are the root cause
The reason Conficker persists is straightforward: millions of machines worldwide still run operating systems that Microsoft stopped supporting years ago. Windows XP reached end of life in April 2014. Windows Server 2003 followed in July 2015. These systems will never receive another security patch.
In many cases, businesses cannot simply upgrade. The software running on these machines — whether it controls a production line, manages medical imaging equipment, or runs a point-of-sale terminal — may be certified only for a specific OS version. Upgrading the operating system could mean replacing the entire application stack, and sometimes the hardware as well.
This creates a vicious cycle. The machine cannot be patched, Conficker infects it, IT staff clean it, and the worm re-infects through the same unpatched vulnerability or a colleague’s USB stick within days.
The industries most at risk
Conficker is not distributed evenly across sectors. It concentrates wherever legacy Windows systems are most entrenched.
Healthcare and medical devices
Hospitals and clinics across Europe still operate MRI scanners, CT machines, and infusion pumps running Windows XP Embedded. A 2024 Forescout report on OT and IoT security found Conficker to be the single most prevalent legacy malware discovered during network assessments in facilities running older Windows systems — appearing in roughly one out of every five scans.
For healthcare organisations subject to the EU’s NIS2 directive, an active Conficker infection represents both a cybersecurity risk and a compliance liability.
Manufacturing and industrial control systems
SCADA systems, programmable logic controllers, and engineering workstations in factories frequently run on Windows XP or Server 2003. These machines often sit on isolated networks, which gives operators a false sense of security. But Conficker’s USB propagation means air gaps are not the barrier they appear to be.
CISA has repeatedly included Conficker in its ICS-CERT advisories as one of the most commonly found pieces of malware in operational technology environments.
Small businesses with aging infrastructure
Many European SMBs — particularly in southern and eastern Europe — still rely on workstations and servers that have not been replaced in over a decade. Budget constraints, the “if it works, don’t touch it” mentality, and a lack of dedicated IT staff all contribute. These businesses often do not even know they are infected until the worm causes noticeable network slowdowns or triggers alerts from their internet provider.
What Conficker actually does to your network
While Conficker’s original operators never deployed a devastating payload, the worm is far from harmless. An active infection causes several problems that directly affect business operations.
It generates significant network traffic as it scans for other vulnerable machines and communicates with its command-and-control infrastructure using a domain generation algorithm that queries up to 50,000 domain names per day. This alone can degrade network performance noticeably, especially on the small networks typical of SMBs.
It disables Windows Update and blocks access to security vendor websites, preventing the infected machine — and sometimes other machines on the network — from downloading patches or antivirus definitions. It also weakens account security by brute-forcing passwords, which can lock out legitimate users.
Perhaps most critically, an active Conficker infection signals to any attacker scanning your network that your systems are unpatched and poorly managed. It is an open invitation.
Practical steps for European SMBs
Addressing the Conficker risk does not require a massive budget, but it does require honest assessment and deliberate action.
Inventory your systems. You cannot protect what you do not know about. Identify every machine on your network, its operating system, and its patch level. Pay special attention to embedded systems, point-of-sale terminals, and any equipment connected to production or medical processes.
Isolate what you cannot patch. If a machine must run Windows XP or Server 2003, place it on a segmented network with no internet access and strict firewall rules. Disable USB autorun via group policy on every machine in your organisation.
Disable unnecessary services. The Server service exploited by MS08-067 is not needed on every workstation. Reducing the attack surface is one of the most effective defences available.
Monitor network traffic. Even basic network monitoring can detect Conficker’s characteristic scanning patterns and DNS queries. Many open-source tools can flag this activity without significant investment.
Plan your migration. Legacy systems represent accumulated technical debt. Under frameworks like NIS2 and GDPR, running unsupported operating systems is increasingly difficult to justify to regulators. Build a realistic timeline and budget for replacing end-of-life systems, starting with those that handle sensitive data or are accessible from the internet.
The real lesson from Conficker
Conficker’s persistence is not a story about a particularly clever piece of malware. The worm exploits a vulnerability that was patched before it even appeared. Every infection that exists today is the result of a patch that was never applied, a system that was never upgraded, or a network that was never properly segmented.
For SMBs across Europe, the message is clear: cybersecurity is not only about defending against the latest zero-day exploit. Sometimes the most dangerous threat on your network is one that has been circulating since 2008 — quietly spreading through the systems you forgot to update.
Need support on this topic? Contact us for a free consultation — let’s assess your company’s situation together.
Stay updated every week on cybersecurity, AI and technology for SMBs: subscribe to our newsletter.