Loading malware…
Linux/Cdorked is a stealthy HTTP backdoor for Apache web servers that was used to hijack legitimate websites and redirect visitors to malicious content, including exploit kits. It is associated with Operation Windigo, a profit-driven server-side malware ecosystem that also included Linux/Ebury, Linux/Onimiki, and Perl/Calfbot. The malware targeted Linux and Unix hosting environments, with reporting repeatedly noting impact on Apache deployments running cPanel, although that did not by itself demonstrate exploitation of a cPanel vulnerability.
Linux/Cdorked modifies the Apache httpd binary and keeps operational state in shared memory, minimizing forensic artifacts on disk and complicating detection. Its configuration can be delivered through obfuscated HTTP requests that do not appear in normal Apache logs. The in-memory payload can be cleared by rebooting, but the altered web-server binary remains a durable sign of compromise. Its primary function was web-traffic redirection: visitors to compromised legitimate sites were selectively sent to attacker-controlled infrastructure serving exploit kits such as Blackhole and later Neutrino. In the Windigo operation, these redirects were used to deliver Windows malware to downstream victims, including Glupteba and Boaxxe variants, with payload selection varying by geography.
The initial root-compromise vector for affected servers was not conclusively established. Contemporary assessments considered stolen credentials, phishing against administrators, and brute-force access plausible paths, and broader Windigo reporting concluded the operation expanded primarily through credential theft rather than novel Linux vulnerabilities. Linux/Cdorked was notable for its stealth, selective redirection logic, and role in monetizing compromised servers through drive-by malware delivery and traffic brokerage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
web visitors accessing pages hosted on websites infected with Linux/Cdorked can be redirected to exploit kits. These exploit kits, if successful, install two different malware families, depending on the visitor’s geographic location. | Web servers infected with Linux/Cdorked redirect users to exploit kit servers, which in turn attempt to infect users with malware.
One can use the following command to determine if the server he is on is compromised: ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
This rule matches the configuration commands that are sent to Linux/Cdorked. Any external host contacting properly identified Web servers on HTTP ports with Linux/Cdorked’s specific cookie and URL will trigger the alert. | The following domains are used to exfiltrate HTTP POST requests over HTTP or HTTPS.
Any external host contacting properly identified Web servers on HTTP ports with Linux/Cdorked’s specific cookie and URL will trigger the alert.
This server is the entry-point of a chain of reverse proxy servers terminating on an exploit serving machine.
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stealthy Linux Apache backdoor that modifies the httpd binary, stores configuration and related data in shared memory, avoids normal Apache logging through obfuscated HTTP requests, and redirects web traffic from compromised servers to malicious websites.
A Linux Apache server backdoor targeting cPanel-based Apache installations. It injects malicious redirects into hosted websites and hands victims off to malware domains serving exploit kit traffic.
Malicious component linked to Operation Windigo and operated by the same group as Linux/Ebury; used as part of the broader server compromise and traffic redirection ecosystem.
A trojanized web server backdoor for Apache, Nginx, and lighttpd that redirects visitors from legitimate websites to exploit kits, malicious content, or advertisement networks. It also includes a connect-back shell for attacker control.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.