RapperBot

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A Mirai derivate bruteforcing SSH servers.

Threat Analysis

RapperBot is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://socradar.io/linux-malware-rapperbot-brute-forcing-ssh-servers/

→https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second

→https://www.fortinet.com/blog/threat-research/new-rapperbot-campaign-ddos-attacks

→https://www.fortinet.com/blog/threat-research/rapperbot-malware-discovery

→https://www.wsj.com/tech/oregon-man-accused-of-operating-one-of-most-powerful-attack-botnets-ever-seen-380b2caf?mod=RSSMSN

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

RapperBotelf.rapper_bot

External Intelligence

Malpedia: elf.rapper_bot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search RapperBot