HOMETHREATSAbcbot
APT / THREAT GROUP

Abcbot

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Abcbot is a modular Go-based botnet and malware that propagates via exploits and brute force attempts. The botnet was observed launching DDoS attacks, perform internet scans, and serve web pages. It is probably linked to Xanthe-based clipjacking campaign.

Threat Analysis

Abcbot is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.netlab.360.com/abcbot_an_evolving_botnet_en/
→https://www.cadosecurity.com/abcbot-an-evolution-of-xanthe/
→https://www.cadosecurity.com/the-continued-evolution-of-abcbot/
→https://www.lacework.com/blog/abc-botnet-attacks-on-the-rise/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Abcbotelf.abcbot

External Intelligence

Malpedia: elf.abcbot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Abcbot