RotaJakiro

Internal ID: elf.rotajakiro

aliases

Last seen:Mar 17, 2026

Intelligence Profile

RotaJakiro is a stealthy Linux backdoor which remained undetected between 2018 and 2021.

The malware uses rotating encryption to encrypt the resource information within the sample, and C2 communication, using a combination of AES, XOR, ROTATE encryption and ZLIB compression.

Threat Analysis

RotaJakiro is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/

→https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/

→https://www.domaintools.com/resources/blog/domaintools-and-digital-archeology-a-look-at-rotajakiro

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.rotajakiro

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search RotaJakiro