Threat Intelligence Directory

Malware family tracked by Malpedia. ID: elf.whirlpool

Malware family tracked by Malpedia. ID: elf.wellmail

According to Intezer, this is a spreader module used by WatchBog. It is a dynamically linked ELF executable, compiled with Cython. C&C adresses are fetched from Pastebin. C&C communication references unique identification keys per victim. It contains a BlueKeep scanner, reporting positively scanned hosts to the C&C server (RC4 encrypted within SSL/TLS). It contains 5 exploits targeting Jira, Exim, Solr, Jenkins and Nexus Repository Manager 3.

Malware family tracked by Malpedia. ID: elf.walkloader

Malware family tracked by Malpedia. ID: elf.vpnfilter

VoidLink is a cloud-native Linux malware family designed as a modular post-exploitation framework for modern cloud and containerized environments. It features a plugin-based architecture with dynamically loadable components that provide reconnaissance, credential harvesting, privilege escalation, lateral movement, persistence, and anti-forensic capabilities. The framework demonstrates strong operational security through runtime encryption, environment awareness (cloud provider and container detection), and the use of user-mode and kernel-level rootkit techniques to evade detection. VoidLink is not a repurposed legacy tool but a purpose-built framework optimized for cloud infrastructure, indicating a shift in advanced threat development toward Linux-based cloud workloads. Although no confirmed large-scale infections have been observed, its maturity and design suggest potential use by sophisticated threat actors for long-term, stealthy access to cloud environments.

According to Synacktiv, vGet is an in-memory stager for vShell, written in Rust.

Malware family tracked by Malpedia. ID: elf.vault8_hive

Enables remote execution of scripts on a host, communicates via Tox.

Malware family tracked by Malpedia. ID: elf.unidentified_005

Implant used by APT31 on compromised SOHO infrastructure, tries to camouflage as a tool ("unifi-video") related to Ubiquiti UniFi surveillance cameras.

According to Cybereason, these scripts have been used in an ongoing campaign exploiting a widespread vulnerability in the Exim MTA: CVE-2019-10149. This attack leverages a week-old vulnerability to gain remote command execution on the target machine, search the Internet for other machines to infect, and initiates a crypto miner.

Malware family tracked by Malpedia. ID: elf.umbreon

Malware family tracked by Malpedia. ID: elf.turla_rat

Malware family tracked by Malpedia. ID: elf.tsh

Malware family tracked by Malpedia. ID: elf.tscookie

Malware family tracked by Malpedia. ID: elf.trump_bot

According to its author, TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology.

Malware family tracked by Malpedia. ID: elf.torii

Malware family tracked by Malpedia. ID: elf.tntbotinger

Malware family tracked by Malpedia. ID: elf.themoon

[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Aqua TeamTNT August 2020)(Citation: Intezer TeamTNT Explosion September 2021)

A malware capable of capturing credentials and enabling backdoor access, implemented as a userland rootkit. It uses three methods for hiding its network activity, by hooking and hijacking 1) fopen/fopen64, 2) eBPF, 3) a set of libpcap functions.

Malware family tracked by Malpedia. ID: elf.sword2033

Malware family tracked by Malpedia. ID: elf.suterusu

Sustes Malware doesn’t infect victims by itself (it’s not a worm) but it is spread over exploitation and brute-force activities with special focus on IoT and Linux servers. The initial infection stage comes from a custom wget directly on the victim machine followed by a simple /bin/bash mr.sh. The script is a simple bash script which drops and executes additional software.

Malware family tracked by Malpedia. ID: elf.sunless

According to FireEye, STEELCORGI is a packer for Linux ELF files that makes use of execution guardrails by sourcing decryption key material from environment variables.

Malware family tracked by Malpedia. ID: elf.stantinko

Malware family tracked by Malpedia. ID: elf.sshdoor

Malware family tracked by Malpedia. ID: elf.sshdinjector

Malware family tracked by Malpedia. ID: elf.spry_socks

Malware family tracked by Malpedia. ID: elf.speculoos

Malware family tracked by Malpedia. ID: elf.specter

Malware family tracked by Malpedia. ID: elf.speakup

According to Mandiant, this is a utility that is written in C and targets Linux. It can be used to extract the uncompressed linux kernel image (vmlinux) into a file and encrypt it using AES without the need for any command line tools.

Malware family tracked by Malpedia. ID: elf.spamtorte

This is an implant used by APT31 on home routers to utilize them as ORBs.

According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell).

According to PwC, SnappyTCP is a simple reverse shell for Linux/Unix systems, with variants for plaintext and TLS communication. SeaTurtle has used SnappyTCP at least between 2021 and 2023.