APT / THREAT GROUP

FritzFrog

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Guardicore has discovered FritzFrog, a sophisticated peer-to-peer (P2P) botnet which has been actively breaching SSH servers since January 2020. It is a worm which is written in Golang, and is modular, multi-threaded and fileless, leaving no trace on the infected machine’s disk.

Threat Analysis

FritzFrog is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/

→https://www.akamai.com/blog/security/fritzfrog-a-new-generation-of-peer-to-peer-botnets

→https://www.akamai.com/blog/security/fritzfrog-p2p

→https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf

→https://www.cyberkendra.com/2024/02/fritzfrog-botnet-expands-attack-arsenal.html

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

elf.fritzfrogFritzFrog

External Intelligence

Malpedia: elf.fritzfrog

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search FritzFrog