APT / THREAT GROUP

Sockbot

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Sockbot is a customized and in Go written fork of the Ligolo reverse tunneling open-source

tool. Several modification were performed by the threat actors who rewrote that code, e.g. execution checks, hardcoded values.

Ligolo: https://github.com/sysdream/ligolo

Threat Analysis

Sockbot is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html

→https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf

→https://www.bleepingcomputer.com/news/security/hackers-fork-open-source-reverse-tunneling-tool-for-persistence/

→https://www.youtube.com/watch?v=CAMnuhg-Qos

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

Sockbotwin.sockbot

External Intelligence

Malpedia: win.sockbot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Sockbot