MALWARE FAMILY

Bifrost

Internal ID: elf.bifrost

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Linux version of the bifrose malware that originally targeted Windows platform only. The backdoor has the ability to perform file management, start or end a process, or start a remote shell. The connection is encrypted using a modified RC4 algorithm.

Threat Analysis

Bifrost is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://cyberandramen.net/2022/12/30/a-quick-look-at-elf-bifrose/

→https://jp.security.ntt/resources/EN-BlackTech_2021.pdf

→https://teamt5.org/tw/posts/technical-analysis-on-backdoor-bifrost-of-the-Chinese-apt-group-huapi/

→https://twitter.com/strinsert1Na/status/1595553530579890176

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.bifrost

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Bifrost