Malware

Xbash

Xbash is a cross-platform malware family associated with opportunistic attacks against Linux and Windows systems, with particular notoriety for targeting exposed database and server environments. It has been observed combining multiple criminal functions, including ransomware-style encryption and network reconnaissance, and has been linked to campaigns seeking to monetize compromised infrastructure through extortion. On compromised systems, Xbash can gather local network information such as IP addressing and intranet details, perform TCP and UDP port scanning, and retrieve updated command-and-control information from online resources. Its execution tradecraft includes abuse of native Windows utilities and scripting engines, including PowerShell, mshta, and regsvr32, as well as execution of malicious JavaScript and VBScript payloads. On Windows, it can establish persistence through Startup-folder mechanisms. The malware’s behavior reflects a blend of reconnaissance, payload staging, execution, persistence, and extortion-oriented activity against internet-exposed enterprise assets, especially database systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

"SpeakUp attempts to exploit...JBoss AS...and the Hadoop YARN ResourceManager." / "Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ..."

Execution

6 techniques

T1053.003CronEvidence1

T1059Command and Scripting InterpreterEvidence1

Cobalt Group has used regsvr32.exe to execute scripts. Saint Bot has used regsvr32 to execute scripts. Xbash can use regsvr32 for executing scripts.

T1059.001PowerShellEvidence6

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'

T1059.005Visual BasicEvidence2

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

T1059.007JavaScriptEvidence2

Adversaries may abuse JavaScript and/or JScript for execution.

T1203Exploitation for Client ExecutionEvidence3

"...leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website." / "...has exploited client software vulnerabilities for execution..." / "...has used multiple software exploits for common client software...to gain code execution."

Persistence

3 techniques

T1053.003CronEvidence1

T1547Boot or Logon Autostart ExecutionEvidence1

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

T1547.001Registry Run Keys / Startup FolderEvidence6

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

Privilege Escalation

3 techniques

T1053.003CronEvidence1

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence6

Stealth

2 techniques

T1218.005MshtaEvidence3

APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

T1218.010Regsvr32Evidence3

AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence6

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1046Network Service DiscoveryEvidence2

The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence6

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1102.001Dead Drop ResolverEvidence1

T1105Ingress Tool TransferEvidence3

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Impact

2 techniques

T1485Data DestructionEvidence2

“Sandworm Team deployed CaddyWiper…to wipe files…along with mapped drives, and physical drive partitions… AcidPour…perform an in-depth wipe…through either data overwrite or calling various IOCTLS… AcidRain performs an in-depth wipe… Apostle…data destruction tool… writes random data… resizing… deleting… BlackEnergy 2 contains a ‘Destroy’ plug-in… overwriting file contents… HermeticWiper… recursively wipe folders and files… Industroyer’s data wiper module clears registry keys and overwrites… KillDisk deletes system files to make the OS unbootable… Shamoon attempts to overwrite operating system files and disk structures… WhisperGate… corrupt files by overwriting…”

T1486Data Encrypted for ImpactEvidence1

Multiple ransomware families and actors are described as encrypting victim filesystems/drives for extortion (e.g., Akira, Conti, Ryuk, WannaCry, NotPetya, etc.), often appending new extensions and dropping ransom notes.

ACTIVITY FEED

Recent activity

35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

35 SOURCESView more in app

levelblue spiderlabs blogNews

Jul 29, 2026

Release the RAVEN: An Offensive Reconnaissance and Attack Tool on Vulnerable Elasticsearch Nodes

Referenced as ransomware in the context of prior research/simulation involving Elasticsearch exposure; not the main subject of this piece.

mitre attack websiteNews

Oct 25, 2022

Command and Scripting Interpreter: Visual Basic, Sub-technique T1059.005 - Enterprise | MITRE ATT&CK®

Can execute malicious VBScript payloads on victim machines.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Collects IP addresses and local intranet information from victim machines.

mitre attack websiteNews

Apr 25, 2022

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Malware that invokes PowerShell to download malicious PE executables or DLLs for execution.

+31 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Xbash