Loading threat actor…
Windigo is a Linux server malware operation centered on trojanized OpenSSH components, most notably the Ebury backdoor and credential stealer. The operation is associated with a broader malware cluster that has included Ebury, Cdorked, Calfbot, Onimiki, and Helimod. It is known for compromising internet-facing Linux servers, maintaining stealthy persistent access through OpenSSH backdoors, harvesting credentials handled by SSH services, and using scripts to profile infected hosts and identify competing OpenSSH implants before deployment. Windigo operators used Perl-based tooling for reconnaissance and post-compromise validation, including checking for artifacts left by other OpenSSH backdoors, gathering credentials stored by such backdoors, and determining the victim Linux distribution and version. The operation therefore demonstrates capabilities spanning reconnaissance, credential theft, persistence, post-exploitation, and exfiltration. ATT&CK-aligned behaviors directly associated with Windigo in the supplied facts include command and scripting interpreter use, shared modules, and escape-to-host behavior in some detections that annotate the actor. Windigo is best known from Operation Windigo, which documented how multiple malware components worked together on compromised Linux infrastructure. Ebury, the most prominent component, functioned as both an OpenSSH backdoor and credential stealer and was reported to have been deployed on tens of thousands of Linux servers worldwide. The operation is generally characterized as a long-running Linux-focused criminal malware ecosystem rather than a nation-state intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
28 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with the generic installation exploitation analytic, but no campaign-specific activity is described in this reference.
Listed as an example threat actor or operation associated with the detection's ATT&CK annotations; no specific campaign or activity is described in this reference.
Mentioned only as an annotated threat actor associated with this generic Linux shared-memory execution detection.
Listed as an associated threat actor in detection annotations for Ghostscript exploitation; no specific campaign activity is described in this reference.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.