HOMETHREATSEbury
APT / THREAT GROUP

Ebury

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

This payload has been used to compromise kernel.org back in August of 2011 and has hit cPanel Support which in turn, has infected quite a few cPanel servers. It is a credential stealing payload which steals SSH keys, passwords, and potentially other credentials.

This family is part of a wider range of tools which are described in detail in the operation windigo whitepaper by ESET.

Threat Analysis

Ebury is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://csirt.gov.it/data/cms/posts/582/attachments/66ca2e9a-68cd-4df5-81a2-674c31a699c2/download
→https://security.web.cern.ch/security/advisories/windigo/windigo.shtml
→https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf
→https://www.acn.gov.it/portale/documents/20119/586040/CSIRT_Italiano_Windigo_Ebury_Variant.pdf
→https://www.justice.gov/opa/pr/russian-citizen-pleads-guilty-involvement-global-botnet-conspiracy

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

elf.eburyEbury

External Intelligence

Malpedia: elf.ebury

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Ebury