PurpleFox malware infects thousands of computers in Ukraine

CERT-UA warns of an active PurpleFox (aka DirtyMoe) malware campaign observed in Ukraine that has infected at least 2,000 systems. PurpleFox is a modular Windows botnet with a rootkit for persistence, functions as a downloader/backdoor and DDoS bot, and spreads via laced MSI installers, known exploits, and brute-force. The advisory includes IoCs, recommended detection steps (registry checks, log/event/port checks, suspicious files/services), and removal guidance including offline disk cleaning and firewall/hardening measures to prevent re-infection.