UPX

UPX is a common public executable packer referenced across multiple malware campaigns as a packing/obfuscation layer rather than as a malware family itself. In the provided reporting, it is used to pack diverse malware including Rust-based P2Pinfect samples recovered from compromised Google Kubernetes Engine/Redis environments, GoBruteforcer Golang botnet binaries targeting phpMyAdmin/MySQL/FTP/Postgres services on Unix-like systems, C++ DLL implants used in archive-based intrusion chains targeting Ukraine and Poland, and an AutoIT backdoor associated with the Dropping Elephant/Patchwork espionage actor. The content also notes attackers sometimes use unaltered versions of common public packers such as UPX. High-confidence details from the content indicate packed samples included Linux and Windows payloads, DLL implants, and botnet/backdoor components; however, UPX itself is described only as the packer used to compress or obfuscate those malicious binaries, not as the malware performing the intrusion or post-compromise actions. No standalone infection vector, C2, or IoCs specific to UPX itself are provided beyond its repeated use as the packing method.