APT / THREAT GROUP

Roboto

aliases

Last seen:Mar 17, 2026

Intelligence Profile

P2P Botnet discovered by Netlab360. The botnet infects linux servers via the Webmin RCE vulnerability (CVE-2019-15107) which allows attackers to run malicious code with root privileges and take over older Webmin versions. Based on the Netlabs360 analysis, the botnet serves mainly 7 functions: reverse shell, self-uninstall, gather process' network information, gather Bot information, execute system commands, run encrypted files specified in URLs and four DDoS attack methods: ICMP Flood, HTTP Flood, TCP Flood, and UDP Flood.

Threat Analysis

Roboto is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.netlab.360.com/the-awaiting-roboto-botnet-en

→https://www.zdnet.com/article/new-roboto-botnet-emerges-targeting-linux-servers-running-webmin

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

elf.robotoRoboto

External Intelligence

Malpedia: elf.roboto

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Roboto