APT / THREAT GROUP

DDG

aliases

Last seen:Mar 17, 2026

Intelligence Profile

First activity observed in October 2017. DDG is a botnet with P2P capability that is targeting crypto currency mining (Monero).

Threat Analysis

DDG is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.netlab.360.com/ddg-a-mining-botnet-aiming-at-database-servers/

→https://blog.netlab.360.com/ddg-botnet-round-x-is-there-an-ending/

→https://blog.netlab.360.com/ddg-mining-botnet-jin-qi-huo-dong-fen-xi/

→https://blog.netlab.360.com/old-botnets-never-die-and-ddg-refuse-to-fade-away/

→https://blog.netlab.360.com/threat-alert-ddg-3013-is-out/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

DDGelf.ddg

External Intelligence

Malpedia: elf.ddg

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DDG