MALWARE FAMILY

FritzFrog

Internal ID: elf.fritzfrog

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Guardicore has discovered FritzFrog, a sophisticated peer-to-peer (P2P) botnet which has been actively breaching SSH servers since January 2020. It is a worm which is written in Golang, and is modular, multi-threaded and fileless, leaving no trace on the infected machine’s disk.

Threat Analysis

FritzFrog is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/

→https://www.akamai.com/blog/security/fritzfrog-a-new-generation-of-peer-to-peer-botnets

→https://www.akamai.com/blog/security/fritzfrog-p2p

→https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf

→https://www.cyberkendra.com/2024/02/fritzfrog-botnet-expands-attack-arsenal.html

→https://www.guardicore.com/2020/08/fritzfrog-p2p-botnet-infects-ssh-servers/

→https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/

→https://www.securityweek.com/sophisticated-fritzfrog-p2p-botnet-returns-after-long-break

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.fritzfrog

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search FritzFrog