BotenaGo

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Alien Labs, this malware targets embedded devices including routers with more than 30 exploits.

SourceCode: https://github.com/Egida/kek/blob/19991ef983f838287aa9362b78b4ed8da0929184/loader_multi.go (2021-10-16)

Threat Analysis

BotenaGo is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits

→https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github

→https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux

→https://lifars.com/2022/01/newly-found-malware-threatens-iot-devices/

→https://www.nozominetworks.com/blog/new-botenago-variant-discovered-by-nozomi-networks-labs/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

BotenaGoelf.botenago

External Intelligence

Malpedia: elf.botenago

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BotenaGo