Threat Intelligence Directory

Malware family identifying elf.habitsrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.gwisin. Origin and technical characteristics tracked via Malpedia.

According to Mandiant, GRIMBOLT is a C#-written foothold backdoor compiled using native ahead-of-time (AOT) compilation and packed with UPX. It provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload. It's unclear if the threat actor's replacement of BRICKSTORM with GRIMBOLT was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response.

Malware family identifying elf.greedyantd. Origin and technical characteristics tracked via Malpedia.

GoTitan is a DDoS bot under development, which support ten different methods of launching distributed denial-of-service (DDoS) attacks: UDP, UDP HEX, TCP, TLS, RAW, HTTP GET, HTTP POST, HTTP HEAD, and HTTP PUT.

Malware family identifying elf.gosh. Origin and technical characteristics tracked via Malpedia.

A DDoS botnet, based on Mirai.

GOREVERSE is a publicly available reverse shell backdoor written in GoLang that operates over Secure Shell (SSH).

Malware family identifying elf.goreshell. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.gomir. Origin and technical characteristics tracked via Malpedia.

According to LAC, this malware is written in Go and was observed in 2022 used by an unknown China-based APT across several incidents in Japan. This backdoor has 20 commands and connects with C2 servers via KCP over UDP.

Malware family identifying elf.godlua. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.gobrat. Origin and technical characteristics tracked via Malpedia.

ARM32 SOCKS proxy, written in Go, used in the Glupteba campaign.

Gitpaste-12 is a modular malware first observed in October 2020 targeting Linux based x86 servers, as well as Linux ARM and MIPS based IoT devices. It uses GitHub and Pastebin as dead drop C2 locations.

Malware family identifying elf.ghostpenguin. Origin and technical characteristics tracked via Malpedia.

According to Synthient, Gaganode is a decentralized bandwidth monetization service that enables both users and publishers to earn crypto for their bandwidth or monetize other people's bandwidth. The SDK intentionally implements RCE, thus aligning Gaganode more closely with malware than standard commercial SDKs.

Guardicore has discovered FritzFrog, a sophisticated peer-to-peer (P2P) botnet which has been actively breaching SSH servers since January 2020. It is a worm which is written in Golang, and is modular, multi-threaded and fileless, leaving no trace on the infected machine’s disk.

This family utilizes custom modules allowing for remote access, credential harvesting (e.g. by modifying sshd) and proxy usage. It comes with a rootkit as well.

Malware used to run a DDoS botnet.

Malware family identifying elf.floodor. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.flodrix. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.firewood. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.finfisher. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.finaldraft. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.fbot. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.facefish. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.ext4. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.exaramel. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.ewdoor. Origin and technical characteristics tracked via Malpedia.

According to Infosec Institute, EvilGnome presents itself to unwitting Linux users as a legitimate GNOME extension. Legitimate extensions help to extend Linux functionality, but instead of a healthy boost in system functionality, EvilGnome begins spying on users with an array of functionalities uncommon for most Linux malware types.

According to the author, Evilginx is a standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.

Ransomware used to target ESXi servers.

Malware family identifying elf.erebus. Origin and technical characteristics tracked via Malpedia.

According to the Infosec Institute, EnemyBot is a dangerous IoT botnet that has made headlines in the last few weeks. This threat, which seems to be disseminated by the Keksec group, expanded its features by adding recent vulnerabilities discovered in 2022. It was designed to attack web servers, Android devices and content management systems (CMS) servers.

Malware family identifying elf.elevator. Origin and technical characteristics tracked via Malpedia.

According to ESET Research, EdgeStepper is an adversary-in-the-middle tool, which forwards DNS traffic from machines in a targeted network to a malicious DNS node. This allows the attackers to redirect the traffic from software updates to a hijacking node that serves instructions to the legitimate software to download a malicious update.

The latest in this long line of Mirai scourges is a new variant named Echobot. Coming to life in mid-May, the malware was first described by Palo Alto Networks in a report published at the start of June, and then again in a report by security researchers from Akamai, in mid-June. When it was first spotted by Palo Alto Networks researchers in early June, Echobot was using exploits for 18 vulnerabilities. In the Akamai report, a week later, Echobot was at 26. https://www.zdnet.com/article/new-echobot-malware-is-a-smorgasbord-of-vulnerabilities

This payload has been used to compromise kernel.org back in August of 2011 and has hit cPanel Support which in turn, has infected quite a few cPanel servers. It is a credential stealing payload which steals SSH keys, passwords, and potentially other credentials. This family is part of a wider range of tools which are described in detail in the operation windigo whitepaper by ESET.

According to Cisco Talos, DriveSwitch is a launcher for SilentRaid.