HOMETHREATSRapperBot
MALWARE FAMILY

RapperBot

Internal ID: elf.rapper_bot
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

A Mirai derivate bruteforcing SSH servers.

Threat Analysis

RapperBot is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://socradar.io/linux-malware-rapperbot-brute-forcing-ssh-servers/
→https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second
→https://www.fortinet.com/blog/threat-research/new-rapperbot-campaign-ddos-attacks
→https://www.fortinet.com/blog/threat-research/rapperbot-malware-discovery
→https://www.wsj.com/tech/oregon-man-accused-of-operating-one-of-most-powerful-attack-botnets-ever-seen-380b2caf?mod=RSSMSN

Quick Facts

TypeMalware Family
Aliases1

Also Known As

elf.rapper_bot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search RapperBot