Father Christmas (Hi.Com Vms) – Dec 22, 1988
On Dec 22, 1988 attack happened. The worm was detected on the Space Physics Analysis Network (SPAN). This was a NASA network on the DECnet Internet with many connections to other networks such as HEPnet. The majority of the computers on SPAN were VAX computers operating VAX/VMS software. The worm originated from a computer on the DECnet in Switzerland by a person using the multi-user login name PHSOLIDE. The infection was thought to have spread to more than 6,000 computer nodes.