MALWARE FAMILY

Ebury

Internal ID: elf.ebury

aliases

Last seen:Mar 17, 2026

Intelligence Profile

This payload has been used to compromise kernel.org back in August of 2011 and has hit cPanel Support which in turn, has infected quite a few cPanel servers. It is a credential stealing payload which steals SSH keys, passwords, and potentially other credentials.

This family is part of a wider range of tools which are described in detail in the operation windigo whitepaper by ESET.

Threat Analysis

Ebury is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://csirt.gov.it/data/cms/posts/582/attachments/66ca2e9a-68cd-4df5-81a2-674c31a699c2/download

→https://security.web.cern.ch/security/advisories/windigo/windigo.shtml

→https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf

→https://www.acn.gov.it/portale/documents/20119/586040/CSIRT_Italiano_Windigo_Ebury_Variant.pdf

→https://www.justice.gov/opa/pr/russian-citizen-pleads-guilty-involvement-global-botnet-conspiracy

→https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/

→https://www.welivesecurity.com/2014/10/15/operation-windigo-good-job-eset-says-malware-author/

→https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/

→https://www.welivesecurity.com/2018/12/05/dark-side-of-the-forsshe/

→https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-linux-servers-compromised-cryptotheft-financial-gain/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.ebury

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Ebury