MalwareUsed by 1 actor

DISGOMOJI

DISGOMOJI is a Linux backdoor associated with the Pakistan-linked threat actor UTA0137. It uses Discord for command-and-control, translating emoji-based messages into operational commands. Supported functions include capturing screenshots, exfiltrating files, and terminating processes. DISGOMOJI establishes persistence through XDG Autostart Entries, placing malicious desktop-entry files in a user autostart location so its backdoor executes whenever the desktop user logs in. Its autostart entries may use legitimate-looking names and extensive comment padding to hinder inspection and forensic analysis.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UTA0137

In one notable campaign, Pakistan-linked APT group UTA0137 used "Disgomoji" malware that translated simple emojis sent over Discord into operational commands.

via dark readingdarkreading.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1547.013XDG Autostart EntriesEvidence2

By leveraging XDG Autostart, attackers can configure malicious applications to run automatically whenever users log into their desktop environment.

Privilege Escalation

1 technique

T1547.013XDG Autostart EntriesEvidence2

By leveraging XDG Autostart, attackers can configure malicious applications to run automatically whenever users log into their desktop environment.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

Threat actors are increasingly leveraging the ubiquity and benign appearance of emojis in different activities, like concealing command-and-control (C2) communications to obfuscate attacks and sneak malware past defenses.

Collection

1 technique

T1113Screen CaptureEvidence1

Examples of the symbolic triggers in Disgomoji included use of a camera emoji to capture screenshots, a fire emoji to exfiltrate files, and a skull emoji to terminate processes.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

In one notable campaign, Pakistan-linked APT group UTA0137 used "Disgomoji" malware that translated simple emojis sent over Discord into operational commands.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Examples of the symbolic triggers in Disgomoji included use of a camera emoji to capture screenshots, a fire emoji to exfiltrate files, and a skull emoji to terminate processes.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

dark readingNews

Apr 8, 2026

Threat Actors Get Crafty With Emojis to Escape Detection

Malware that uses emoji-based command-and-control over Discord, translating emojis into operational commands such as capturing screenshots, exfiltrating files, and terminating processes.

picus security blogNews

Mar 30, 2026

T1547.013 XDG Autostart Entries in MITRE ATT&CK Explained

Linux malware that maintains persistence by dropping .desktop files such as GNOME_Core.desktop or GNOME_GNU.desktop into ~/.config/autostart so its executable runs automatically at each user login; it also pads files with large numbers of # characters to hinder analysis.

elastic security labsNews

Aug 21, 2024

Linux Detection Engineering - A primer on persistence mechanisms

Malware referenced as using an XDG .desktop autostart entry in ~/.config/autostart/ to execute a planted backdoor at user desktop login.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DISGOMOJI