HOMETHREATSDDG
MALWARE FAMILY

DDG

Internal ID: elf.ddg
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

First activity observed in October 2017. DDG is a botnet with P2P capability that is targeting crypto currency mining (Monero).

Threat Analysis

DDG is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.netlab.360.com/ddg-a-mining-botnet-aiming-at-database-servers/
→https://blog.netlab.360.com/ddg-botnet-round-x-is-there-an-ending/
→https://blog.netlab.360.com/ddg-mining-botnet-jin-qi-huo-dong-fen-xi/
→https://blog.netlab.360.com/old-botnets-never-die-and-ddg-refuse-to-fade-away/
→https://blog.netlab.360.com/threat-alert-ddg-3013-is-out/

Quick Facts

TypeMalware Family
Aliases1

Also Known As

elf.ddg

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search DDG