Windigo

Introduction

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019. ESET Windigo Mar 2014 CERN Windigo June 2019

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1082 System Information Discovery
• T1005 Data from Local System
• T1518 Software Discovery
• T1090 Proxy
• T1059 Command and Scripting Interpreter
• T1083 File and Directory Discovery
• T1189 Drive-by Compromise

ATT&CK technique IDs (denormalized)

• T1005
• T1059
• T1082
• T1083
• T1090
• T1189
• T1518

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• Backdoor.Oldrea:
• CyberGate:
• Cyber Eye RAT:

MITRE ATT&CK Software

• Ebury (S0377) — malware

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [2] ESET Windigo Mar 2014 Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021. [3] CERN Windigo June 2019 CERN. (2019, June 4). 2019/06/04 Advisory: Windigo attacks. Retrieved February 10, 2021.