Xnote
Xnote is a Linux backdoor first discovered in 2015 and observed in the wild since then. It has been deployed in multiple intrusion sets, including by the adversarial collective Earth Berberoka (aka GamblingPuppet) in attacks targeting online gambling sites. Palo Alto Networks Unit 42 also reported Xnote being used in some intrusions attributed to the cluster CL-UNK-1068 (assessed as a Chinese threat actor), where it was occasionally installed on Linux servers as part of post-compromise tooling to maintain access alongside modified Fast Reverse Proxy (FRP) builds used for command-and-control and network-control bypass. Separately, reporting described Xnote being deployed by the Southeast Asia-based actor UTG-Q-015 against Linux systems in AI research environments, following exploitation of CVE-2023-48022 and misconfigured ComfyUI components, where Xnote was used as a lightweight backdoor. In the CL-UNK-1068 context, the Xnote variant is described as providing DDoS capabilities and other commands. No specific Xnote indicators of compromise (e.g., hashes, C2 domains/IPs) are provided in the supplied content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Further, to maintain command-and-control (C2) access and bypass network controls, the actor also deploys modified builds of Fast Reverse Proxy (FRP) and occasionally installs the Xnote Linux backdoor.
“...Xnote is a Linux backdoor that's been detected in the wild since 2015 and has been deployed by ... Earth Berberoka (aka GamblingPuppet) ...”
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Command and Control
1 technique
Command and Control
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux backdoor used to provide unauthorized remote access on compromised Linux systems.
Linux backdoor used to maintain persistent remote access and support command-and-control on compromised Linux hosts.
Linux backdoor (first reported 2015) used here primarily for DDoS capabilities plus file operations, reverse shell, port forwarding, and reverse proxy/tunneling tasks.
Lightweight backdoor used for persistent access and C2 on compromised Linux systems, particularly in AI research environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.