DNS Changes Lead To W32/Rorpian

This report documents an active Rorpian worm infection that leverages the MS10-046 LNK vulnerability (and other exploits) to drop a TDSS rootkit, modify DHCP-provided DNS settings to redirect hosts to a malicious IP (188.229.89.121), and contact a C2 with observable check-in parameters and known MD5s and DLLs; it includes indicators and contextual threat intelligence for containment and detection.