HOMETHREATSBifrost
APT / THREAT GROUP

Bifrost

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Linux version of the bifrose malware that originally targeted Windows platform only. The backdoor has the ability to perform file management, start or end a process, or start a remote shell. The connection is encrypted using a modified RC4 algorithm.

Threat Analysis

Bifrost is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cyberandramen.net/2022/12/30/a-quick-look-at-elf-bifrose/
→https://jp.security.ntt/resources/EN-BlackTech_2021.pdf
→https://teamt5.org/tw/posts/technical-analysis-on-backdoor-bifrost-of-the-Chinese-apt-group-huapi/
→https://twitter.com/strinsert1Na/status/1595553530579890176

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

Bifrostelf.bifroseelf.bifrost

External Intelligence

Malpedia: elf.bifrost

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Bifrost