Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Other tools linked to the actor in previous attacks include Slapstick, Tinyshell, Steelhound, Steelcorgi, Wingjook, Wingcrack, Binbash, Wiperight, and the Mignogcleaner, all of which Mandiant confirmed as still deployed in LightBasin attacks.
BINBASH is a simple ELF utility that executes a shell after setting the group ID and user ID to either "root" or specified values.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
"BINBASH...executes a shell after setting the group ID and user ID to either 'root' or specified values."
MITRE list: "T1105:Ingress Tool Transfer" and description of deploying multiple utilities/toolkit components.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.