Nimda
loresecurity
The September 2001 worm that attacked through five vectors at once, a week after 9/11.
Released on September 18, 2001, Nimda (admin backwards) spread by email, open network shares, defaced websites that infected their visitors, IIS exploits, and the backdoors left by Code Red II, becoming the Internet's most widespread worm within hours. Arriving days after the attacks on New York, it triggered brief fears of cyberterrorism that analysis never supported. It taught defenders that malware need not choose a single door.
Nimda, in September 2001, is remembered for using five propagation methods simultaneously: email, open network shares, infected websites serving it to visitors, a backdoor left by Code Red, and direct exploitation of the web server. Any one defence stopped one path and none stopped it.
That multiplicity is the point. Security controls tend to be organized by channel, with mail filtering, web filtering, and network access controls owned by different teams and evaluated separately, and a threat that crosses all of them at once finds the seams between them. It also propagated both from clients to servers and from servers back to clients, which broke the mental model that traffic flows one way.
Its timing, a week after the September 11 attacks, contributed to a period of genuine confusion about attribution and motive, and it is a reasonable illustration of why attribution during an incident is usually premature. The durable lesson is architectural: defence organized around channels is defeated by a threat organized around objectives, which is the argument for layered controls that assume any single path may already be compromised.