CDorked

aliases

Last seen:Mar 17, 2026

Intelligence Profile

This is in the same family as eBury, Calfbot, and is also likely related to DarkLeech

Threat Analysis

CDorked is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.symantec.com/security-center/writeup/2013-050214-5501-99

→https://blogs.cisco.com/security/linuxcdorked-faqs

→https://www.welivesecurity.com/2013/05/02/the-stealthiness-of-linuxcdorked-a-clarification/

→https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/

→https://blog.sucuri.net/2014/03/windigo-linux-analysis-ebury-and-cdorked.html

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

elf.cdorkedCDorked.ACDorked

External Intelligence

Malpedia: elf.cdorked

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CDorked