Loading malware…
MIGLOGCLEANER is an ELF anti-forensics utility for Linux and Unix-based systems that wipes selected logs or removes specified strings from log records. It enables attackers to selectively alter logging evidence and obscure traces of activity on compromised hosts. Its source code is publicly available on GitHub.
MIGLOGCLEANER has been used by UNC2891, a financially motivated threat actor targeting banking and ATM infrastructure. It forms part of the actor’s broader toolkit for concealing intrusions, alongside backdoors, credential-stealing tools, and other log-cleaning utilities. Its established role is log manipulation and defense evasion rather than initial access or transaction manipulation.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
MIGLOGCLEANER utility provides an attacker with an ability to clean or tamper specified logs in an anti-forensics way.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
"UNC2891 deployed a range of custom malware, including CAKETAP (a Solaris/Linux rootkit)... attackers maintained undetected access for years"
The threat actor disguised deployed malware with legitimate-looking names.
"LOGBLEACH/MIGLOGCLEANER (log wipers)"
MITRE list: "T1070.004:File Deletion"
Both tools were capable of wiping entire logs or selectively removing specific entries or strings based on defined criteria.
MITRE list: "T1105:Ingress Tool Transfer" and description of deploying multiple utilities/toolkit components.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.