Threat Intelligence Directory

Malware family identifying elf.vermilion_strike. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.vault8_hive. Origin and technical characteristics tracked via Malpedia.

Enables remote execution of scripts on a host, communicates via Tox.

Malware family identifying elf.unidentified_005. Origin and technical characteristics tracked via Malpedia.

Implant used by APT31 on compromised SOHO infrastructure, tries to camouflage as a tool ("unifi-video") related to Ubiquiti UniFi surveillance cameras.

According to Cybereason, these scripts have been used in an ongoing campaign exploiting a widespread vulnerability in the Exim MTA: CVE-2019-10149. This attack leverages a week-old vulnerability to gain remote command execution on the target machine, search the Internet for other machines to infect, and initiates a crypto miner.

Malware family identifying elf.umbreon. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.turla_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.tsunami. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.tsh. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.tscookie. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.trump_bot. Origin and technical characteristics tracked via Malpedia.

According to its author, TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology.

Malware family identifying elf.torii. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.tntbotinger. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.themoon. Origin and technical characteristics tracked via Malpedia.

Since Fall 2019, Team TNT is a well known threat actor which targets *nix based systems and misconfigured Docker container environments. It has constantly evolved its capabilities for its cloud-based cryptojacking operations. They have shifted their focus on compromising Kubernetes Clusters.

Malware family identifying elf.systembc. Origin and technical characteristics tracked via Malpedia.

Cryptojacking botnet

Malware family identifying elf.sysjoker. Origin and technical characteristics tracked via Malpedia.

A malware capable of capturing credentials and enabling backdoor access, implemented as a userland rootkit. It uses three methods for hiding its network activity, by hooking and hijacking 1) fopen/fopen64, 2) eBPF, 3) a set of libpcap functions.

Malware family identifying elf.sword2033. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.suterusu. Origin and technical characteristics tracked via Malpedia.

Sustes Malware doesn’t infect victims by itself (it’s not a worm) but it is spread over exploitation and brute-force activities with special focus on IoT and Linux servers. The initial infection stage comes from a custom wget directly on the victim machine followed by a simple /bin/bash mr.sh. The script is a simple bash script which drops and executes additional software.

Malware family identifying elf.sunless. Origin and technical characteristics tracked via Malpedia.

According to FireEye, STEELCORGI is a packer for Linux ELF files that makes use of execution guardrails by sourcing decryption key material from environment variables.

Malware family identifying elf.stantinko. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.sshdoor. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.sshdinjector. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.spry_socks. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.speculoos. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.spectral_blur. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.specter. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.speakup. Origin and technical characteristics tracked via Malpedia.

According to Mandiant, this is a utility that is written in C and targets Linux. It can be used to extract the uncompressed linux kernel image (vmlinux) into a file and encrypt it using AES without the need for any command line tools.

Malware family identifying elf.spamtorte. Origin and technical characteristics tracked via Malpedia.

This is an implant used by APT31 on home routers to utilize them as ORBs.

According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell).

According to PwC, SnappyTCP is a simple reverse shell for Linux/Unix systems, with variants for plaintext and TLS communication. SeaTurtle has used SnappyTCP at least between 2021 and 2023.

According to FireEye, SLAPSTICK is a Solaris PAM backdoor that grants a user access to the system with a secret, hard-coded password.