Hide and Seek

Internal ID: elf.hideandseek

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying elf.hideandseek. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

Hide and Seek is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.avast.com/hide-n-seek-botnet-continues

→https://blog.netlab.360.com/hns-botnet-recent-activities-en/

→https://labs.bitdefender.com/2018/01/new-hide-n-seek-iot-botnet-using-custom-built-peer-to-peer-communication-spotted-in-the-wild/

→https://labs.bitdefender.com/2018/05/hide-and-seek-iot-botnet-resurfaces-with-new-tricks-persistence/

→https://threatlabs.avast.com/botnet

→https://unit42.paloaltonetworks.com/hide-n-seek-botnet-updates-arsenal-with-exploits-against-nexus-repository-manager-thinkphp/

→https://www.bleepingcomputer.com/news/security/hide-and-seek-becomes-first-iot-botnet-capable-of-surviving-device-reboots/

→https://www.bleepingcomputer.com/news/security/hns-evolves-from-iot-to-cross-platform-botnet/

→https://www.bleepingcomputer.com/news/security/new-hns-iot-botnet-has-already-amassed-14k-bots/

→https://www.fortinet.com/blog/threat-research/searching-for-the-reuse-of-mirai-code--hide--n-seek-bot.html

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.hideandseek

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Hide and Seek