Threat Intelligence Directory

Malware family tracked by Malpedia. ID: elf.hideandseek

HiddenWasp is a Linux-based Trojan used to target systems for remote control. It comes in the form of a statically linked ELF binary with stdlibc++.

Lumen discovered this malware used in campaign targeting business-grade routers using a RAT they call HiatusRAT and a variant of tcpdump for traffic interception.

Helldown is an aggressive ransomware group first documented in August 2024, known for exploiting Zyxel firewall vulnerabilities to gain initial access and conducting large-scale data exfiltration averaging 70 GB per victim, targeting IT services, telecommunications, manufacturing, and healthcare primarily in the US.

Malware family tracked by Malpedia. ID: elf.headcrab

Malware family tracked by Malpedia. ID: elf.hand_of_thief

Malware family tracked by Malpedia. ID: elf.handymannypot

Malware family tracked by Malpedia. ID: elf.hakai

Malware family tracked by Malpedia. ID: elf.hajime

Malware family tracked by Malpedia. ID: elf.haiduc

Malware family tracked by Malpedia. ID: elf.hadooken

According to Mandiant, GRIMBOLT is a C#-written foothold backdoor compiled using native ahead-of-time (AOT) compilation and packed with UPX. It provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload. It's unclear if the threat actor's replacement of BRICKSTORM with GRIMBOLT was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response.

Malware family tracked by Malpedia. ID: elf.greedyantd

GoTitan is a DDoS bot under development, which support ten different methods of launching distributed denial-of-service (DDoS) attacks: UDP, UDP HEX, TCP, TLS, RAW, HTTP GET, HTTP POST, HTTP HEAD, and HTTP PUT.

Malware family tracked by Malpedia. ID: elf.gosh

Gorilla is a threat-actor operating a DoS-as-a-service service controlled on Telegram.

GOREVERSE is a publicly available reverse shell backdoor written in GoLang that operates over Secure Shell (SSH).

Malware family tracked by Malpedia. ID: elf.goreshell

Malware family tracked by Malpedia. ID: elf.gomir

According to LAC, this malware is written in Go and was observed in 2022 used by an unknown China-based APT across several incidents in Japan. This backdoor has 20 commands and connects with C2 servers via KCP over UDP.

Malware family tracked by Malpedia. ID: elf.godlua

Malware family tracked by Malpedia. ID: elf.gobrat

ARM32 SOCKS proxy, written in Go, used in the Glupteba campaign.

Gitpaste-12 is a modular malware first observed in October 2020 targeting Linux based x86 servers, as well as Linux ARM and MIPS based IoT devices. It uses GitHub and Pastebin as dead drop C2 locations.

Malware family tracked by Malpedia. ID: elf.ghostpenguin

Guardicore has discovered FritzFrog, a sophisticated peer-to-peer (P2P) botnet which has been actively breaching SSH servers since January 2020. It is a worm which is written in Golang, and is modular, multi-threaded and fileless, leaving no trace on the infected machine’s disk.

This family utilizes custom modules allowing for remote access, credential harvesting (e.g. by modifying sshd) and proxy usage. It comes with a rootkit as well.

Malware used to run a DDoS botnet.

Malware family tracked by Malpedia. ID: elf.floodor

Malware family tracked by Malpedia. ID: elf.flodrix

Malware family tracked by Malpedia. ID: elf.firewood

Malware family tracked by Malpedia. ID: elf.fbot

Malware family tracked by Malpedia. ID: elf.facefish

Malware family tracked by Malpedia. ID: elf.ext4

Malware family tracked by Malpedia. ID: elf.ewdoor

According to Infosec Institute, EvilGnome presents itself to unwitting Linux users as a legitimate GNOME extension. Legitimate extensions help to extend Linux functionality, but instead of a healthy boost in system functionality, EvilGnome begins spying on users with an array of functionalities uncommon for most Linux malware types.

According to the author, Evilginx is a standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.

Ransomware used to target ESXi servers.

According to the Infosec Institute, EnemyBot is a dangerous IoT botnet that has made headlines in the last few weeks. This threat, which seems to be disseminated by the Keksec group, expanded its features by adding recent vulnerabilities discovered in 2022. It was designed to attack web servers, Android devices and content management systems (CMS) servers.

Malware family tracked by Malpedia. ID: elf.elevator