Skip to main content
Mallory
Back to malware
MalwareUsed by 2 actors

kworker

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial
THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Red Lamassu

“Our analysis revolves around an open directory found during our hunting of Red Lamassu, containing both an aforementioned kworker sample, alongside a fully featured Windows backdoor, which we call JFMBackdoor.”

via security online infosecurityonline.info
Calypso APT

“Our analysis revolves around an open directory found during our hunting of Red Lamassu, containing both an aforementioned kworker sample, alongside a fully featured Windows backdoor, which we call JFMBackdoor.”

via security online infosecurityonline.info
MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique
T1543.003Windows ServiceEvidence1

establish persistence via a new service

Privilege Escalation

1 technique
T1543.003Windows ServiceEvidence1

establish persistence via a new service

Stealth

1 technique
T1564Hide ArtifactsEvidence1

The malware can also upload or download files, hide its own process... One notable feature is the 'hide' command, which enables a process to conceal itself on a host machine

Discovery

1 technique
T1082System Information DiscoveryEvidence1

once Showboat is deployed on a target system, it starts collecting information about the host and sends it to a command-and-control (C2) server

Lateral Movement

1 technique
T1021Remote ServicesEvidence1

serving as a foothold on compromised endpoints and enabling the attackers to move to other systems on the internal network

Command and Control

4 techniques
T1071Application Layer ProtocolEvidence1

once Showboat is deployed on a target system, it starts collecting information about the host and sends it to a command-and-control (C2) server

T1090ProxyEvidence1

Its most notable function is acting as a SOCKS5 proxy and port-forwarding pivot point, serving as a foothold on compromised endpoints and enabling the attackers to move to other systems on the internal network

T1102.001Dead Drop ResolverEvidence1

retrieving code stored on external websites such as Pastebin or online forums for use as a ‘dead drop’

T1105Ingress Tool TransferEvidence1

The malware can also upload or download files

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
Start free trial
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.