Threat Intelligence Directory

Malware family identifying elf.dreambus. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.doublefantasy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.doki. Origin and technical characteristics tracked via Malpedia.

Dofloo (aka AESDDoS) is a popular malware used to create large scale botnets that can launch DDoS attacks and load cryptocurrency miners to the infected machines.

Malware family identifying elf.disgomoji. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.derusbi. Origin and technical characteristics tracked via Malpedia.

Cado discovered this malware, written in Go and targeting AWS Lambda environments.

Malware family identifying elf.decoy_dog. Origin and technical characteristics tracked via Malpedia.

DEADBOLT is a linux ransomware written in Go, targeting QNAP NAS devices worldwide. The files are encrypted with AES128 encryption and will have the .deadbolt extension appended to file names.

Malware family identifying elf.ddoor. Origin and technical characteristics tracked via Malpedia.

First activity observed in October 2017. DDG is a botnet with P2P capability that is targeting crypto currency mining (Monero).

Malware family identifying elf.dark_radiation. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.darkside. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.darknexus. Origin and technical characteristics tracked via Malpedia.

A sophisticated payload delivery and upgrade framework, discovered in 2024. DarkCracks exploits compromised GLPI and WordPress sites to function as Downloaders and C2 servers.

Mirai variant exploiting CVE-2021-20090 and CVE2021-35395 for spreading.

According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely. Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.

According to CISA, Cyclops Blink appears to be a replacement framework for the VPNFilter malware exposed in 2018, and which exploited network devices, primarily small office/home office (SOHO) routers and network attached storage (NAS) devices. Cyclops Blink has been deployed since at least June 2019, fourteen months after VPNFilter was disrupted. In common with VPNFilter, Cyclops Blink deployment also appears indiscriminate and widespread. The actor has so far primarily deployed Cyclops Blink to WatchGuard and ASUS devices, but it is likely that Sandworm would be capable of compiling the malware for other architectures and firmware.

A malware written in Bash that hides in the Linux calendar system on February 31st. Observed in relation to Magecart attacks.

Malware family identifying elf.cr1ptt0r. Origin and technical characteristics tracked via Malpedia.

This was observed to be pushed by IoT malware, abusing devices for LiteCoin and BitCoin mining.

Malware family identifying elf.corona. Origin and technical characteristics tracked via Malpedia.

Ransomware

ConnectBack malware is a type of malicious software designed to establish unauthorized connections from an infected system to a remote server. Once a victim's device is compromised, ConnectBack creates a covert channel for communication, allowing the attacker to remotely control and gather sensitive information from the compromised system.

According to CISA, this is an implant found in firmware for the Contec CMS8000, a patient monitor used by the Healthcare and Public Health sector. An embedded backdoor function with a hard-coded IP address and functionality that enables patient data spillage was identified.

Malware family identifying elf.cloud_snooper. Origin and technical characteristics tracked via Malpedia.

ELF version of clop ransomware.

Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go. While benign in itself, Chisel has been utilized by multiple threat actors. It was for example observed by SentinelOne during a PYSA ransomware campaign to achieve persistence and used as backdoor. Github: https://github.com/jpillora/chisel

Malware family identifying elf.chapro. Origin and technical characteristics tracked via Malpedia.

Multi-functional malware written in Go, targeting both Linux and Windows, evolved from elf.kaiji.

Sophos describes this malware as a DDoS bot, with its name originating from ChaCha-Lua-bot due to its use of ChaCha cipher and Lua. Variants exist for multiple architectures and it incorporates code from XorDDoS and Mirai.

Malware family identifying elf.cetus. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.cephei. Origin and technical characteristics tracked via Malpedia.

Malware family identifying elf.cdrthief. Origin and technical characteristics tracked via Malpedia.

This is in the same family as eBury, Calfbot, and is also likely related to DarkLeech

A backdoor for UNIX operating systems that implements knocking as authentication method.

XMRig-based mining malware written in Go.

According to Avast Decoded, Caligula is an IRC multiplatform bot that allows to perform DDoS attacks. It is written in Go and distributed in ELF files targeting Intel 32/64bit code, as well as ARM 32bit and PowerPC 64bit. It is based on the Hellabot open source project.

Linux malware cross-compiled for x86, MIPS, ARM. XOR encoded strings, 13 commands supported for its C&C, including downloading, file modification and execution and ability to run shell commands.

Pangu Lab discovered this backdoor during a forensic investigation in 2013. They refer to related incidents as "Operation Telescreen".