BotenaGo

Internal ID: elf.botenago

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Alien Labs, this malware targets embedded devices including routers with more than 30 exploits.

SourceCode: https://github.com/Egida/kek/blob/19991ef983f838287aa9362b78b4ed8da0929184/loader_multi.go (2021-10-16)

Threat Analysis

BotenaGo is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits

→https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github

→https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux

→https://lifars.com/2022/01/newly-found-malware-threatens-iot-devices/

→https://www.nozominetworks.com/blog/new-botenago-variant-discovered-by-nozomi-networks-labs/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.botenago

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BotenaGo