MalwareExploits 7 CVEs

WatchBog

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

7 CVES

CVE-2019-11581Remote Code Execution in Atlassian Jira Server and Data CenterExploited in the wild

We have detected a new version of WatchBog, which incorporates recently published exploits—among them being Jira’s CVE-2019-11581... | WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018... We have detected a new version of WatchBog, which incorporates recently published exploits...

via intezer blogintezer.com

CVE-2016-3088Authenticated arbitrary file upload and RCE in Apache ActiveMQ Fileserver

We were able to find an early test version of the spreader module uploaded to HybridAnalysis, including an exploit to Solr CVE-2019-0192, an exploit to ActiveMQ CVE-2016-3088... | WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018... We have detected a new version of WatchBog, which incorporates recently published exploits...

via intezer blogintezer.com

CVE-2019-0708BlueKeep

BlueKeep, also known as CVE-2019-0708, is a Windows-based kernel vulnerability, which allows an attacker to gain RCE over a vulnerable system... There is no known public PoC available for achieving RCE with this vulnerability, and no attack has been spotted in the wild yet. | WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018... We have detected a new version of WatchBog, which incorporates recently published exploits...

via intezer blogintezer.com

CVE-2018-1000861Jenkins Stapler Web Framework Remote Code ExecutionExploited in the wild

The WatchBog client includes five exploits for the following CVEs: CVE-2018-1000861 (Jenkins)... | WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018... We have detected a new version of WatchBog, which incorporates recently published exploits...

via intezer blogintezer.com

CVE-2019-7238RCE in Sonatype Nexus Repository Manager before 3.15.0Exploited in the wild

The WatchBog client includes five exploits for the following CVEs: ... CVE-2019-7238 (Nexus Repository Manager 3) | WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018... We have detected a new version of WatchBog, which incorporates recently published exploits...

via intezer blogintezer.com

CVE-2019-10149Exim deliver_message() Recipient Address Command InjectionExploited in the wild

We have detected a new version of WatchBog, which incorporates recently published exploits—among them being... Exim’s CVE-2019-10149... | WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018... We have detected a new version of WatchBog, which incorporates recently published exploits...

via intezer blogintezer.com

CVE-2019-0192Remote Code Execution in Apache Solr Config API JMX ConfigurationExploited in the wild

We have detected a new version of WatchBog, which incorporates recently published exploits—among them being... Solr’s CVE-2019-0192. | WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018... We have detected a new version of WatchBog, which incorporates recently published exploits...

via intezer blogintezer.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018. The group is known to be exploiting known vulnerabilities to compromise Linux servers.

Execution

2 techniques

T1053.003CronEvidence2

This script sets up persistence via crontab and downloads further Monero miner modules from Pastebin, as has been previously documented by Alibaba Cloud.

T1059.004Unix ShellEvidence1

Once a vulnerable service is discovered to which exists an exploit module, the binary spreads itself by invoking the right exploit and installing a malicious bash script hosted on Pastebin.

Persistence

2 techniques

T1053.003CronEvidence2

This script sets up persistence via crontab and downloads further Monero miner modules from Pastebin, as has been previously documented by Alibaba Cloud.

T1098.004SSH Authorized KeysEvidence1

It also checks for the existence of SSH keys and leverages them to authenticate to the systems in the known_hosts file.

Privilege Escalation

2 techniques

T1053.003CronEvidence2

This script sets up persistence via crontab and downloads further Monero miner modules from Pastebin, as has been previously documented by Alibaba Cloud.

T1098.004SSH Authorized KeysEvidence1

It also checks for the existence of SSH keys and leverages them to authenticate to the systems in the known_hosts file.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

There were some attempts at obfuscation, such as base64 encoding URLs and Pastebins, but the attack was still relatively simple to uncover.

T1070.004File DeletionEvidence1

Evidence deletion was performed in a clear manner with files and logs being deleted or overwritten.

Credential Access

1 technique

T1110Brute ForceEvidence1

Furthermore, two modules for bruteforcing CouchDB and Redis instances exist together along with code to achieve RCE.

Discovery

2 techniques

T1046Network Service DiscoveryEvidence3

In this newer version of WatchBog it seems that the group has integrated an RDP scanner in order to find vulnerable Windows machines to the BlueKeep vulnerability.

T1082System Information DiscoveryEvidence1

The initial message contains the compromised system information: This information will be merged and hashed to build the route of WatchBog’s API hosted in its CNCs.

Lateral Movement

1 technique

T1021.004SSHEvidence1

CSIRS identified that the adversary was using SSH to spread laterally.

Command and Control

4 techniques

T1001Data ObfuscationEvidence1

These packets were encoded to obfuscate its content. During the analysis, we were able to determine the encoding algorithm used.

T1071Application Layer ProtocolEvidence2

The binary first attempts to connect to one of the available static C2 servers. We observed that the onion C2 server had an expired certificate.

T1090.003Multi-hop ProxyEvidence1

An .onion C2 server address is also hardcoded in the binary and is used as a fallback.

T1105Ingress Tool TransferEvidence2

This script sets up persistence via crontab and downloads further Monero miner modules from Pastebin... the script downloads another base64-encoded payload from Pastebin, which further downloads another module and then executes it.

Impact

1 technique

T1496Resource HijackingEvidence1

What does Watchbog do? The Watchbog botnet mines Monero cryptocurrency for its owners.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

uri●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

intezer blogNews

Jan 1, 2026

WatchBog: New BlueKeep Vulnerability Scanner & Linux Exploits - Intezer

A Linux-focused cryptocurrency-mining botnet that deploys Monero miner modules, maintains persistence via crontab, retrieves C2 infrastructure from Pastebin and a hardcoded onion fallback, and spreads by exploiting multiple RCE vulnerabilities and brute-forcing exposed services. The newer version also includes a BlueKeep/RDP scanner to identify vulnerable Windows systems.

talosintelligence otherNews

Sep 11, 2019

Watchbog and the Importance of Patching

Linux-based malware/botnet that uses Pastebin for C2, installs Monero mining payloads, spreads laterally via SSH and by scanning/exploiting Jenkins and Redis servers, persists via cron jobs, and deletes evidence.

zdnet zero dayNews

Jul 25, 2019

US company selling weaponized BlueKeep exploit | ZDNET

A botnet of hijacked Linux servers involved in stealthy crypto-mining operations; its operators added a BlueKeep scanner to identify vulnerable Windows systems for future targeting or resale.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities7

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 7 CVEs

WatchBog

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

7 CVES

CVE-2019-11581Remote Code Execution in Atlassian Jira Server and Data CenterExploited in the wild

via intezer blogintezer.com

CVE-2016-3088Authenticated arbitrary file upload and RCE in Apache ActiveMQ Fileserver

via intezer blogintezer.com

CVE-2019-0708BlueKeep

via intezer blogintezer.com

CVE-2018-1000861Jenkins Stapler Web Framework Remote Code ExecutionExploited in the wild

via intezer blogintezer.com

CVE-2019-7238RCE in Sonatype Nexus Repository Manager before 3.15.0Exploited in the wild

via intezer blogintezer.com

CVE-2019-10149Exim deliver_message() Recipient Address Command InjectionExploited in the wild

via intezer blogintezer.com

CVE-2019-0192Remote Code Execution in Apache Solr Config API JMX ConfigurationExploited in the wild

via intezer blogintezer.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

WatchBog is a cryptocurrency-mining botnet that was spotted as early as November 2018. The group is known to be exploiting known vulnerabilities to compromise Linux servers.

Execution

2 techniques

T1053.003CronEvidence2

This script sets up persistence via crontab and downloads further Monero miner modules from Pastebin, as has been previously documented by Alibaba Cloud.

T1059.004Unix ShellEvidence1

Once a vulnerable service is discovered to which exists an exploit module, the binary spreads itself by invoking the right exploit and installing a malicious bash script hosted on Pastebin.

Persistence

2 techniques

T1053.003CronEvidence2

This script sets up persistence via crontab and downloads further Monero miner modules from Pastebin, as has been previously documented by Alibaba Cloud.

T1098.004SSH Authorized KeysEvidence1

It also checks for the existence of SSH keys and leverages them to authenticate to the systems in the known_hosts file.

Privilege Escalation

2 techniques

T1053.003CronEvidence2

This script sets up persistence via crontab and downloads further Monero miner modules from Pastebin, as has been previously documented by Alibaba Cloud.

T1098.004SSH Authorized KeysEvidence1

It also checks for the existence of SSH keys and leverages them to authenticate to the systems in the known_hosts file.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

There were some attempts at obfuscation, such as base64 encoding URLs and Pastebins, but the attack was still relatively simple to uncover.

T1070.004File DeletionEvidence1

Evidence deletion was performed in a clear manner with files and logs being deleted or overwritten.

Credential Access

1 technique

T1110Brute ForceEvidence1

Furthermore, two modules for bruteforcing CouchDB and Redis instances exist together along with code to achieve RCE.

Discovery

2 techniques

T1046Network Service DiscoveryEvidence3

In this newer version of WatchBog it seems that the group has integrated an RDP scanner in order to find vulnerable Windows machines to the BlueKeep vulnerability.

T1082System Information DiscoveryEvidence1

The initial message contains the compromised system information: This information will be merged and hashed to build the route of WatchBog’s API hosted in its CNCs.

Lateral Movement

1 technique

T1021.004SSHEvidence1

CSIRS identified that the adversary was using SSH to spread laterally.

Command and Control

4 techniques

T1001Data ObfuscationEvidence1

These packets were encoded to obfuscate its content. During the analysis, we were able to determine the encoding algorithm used.

T1071Application Layer ProtocolEvidence2

The binary first attempts to connect to one of the available static C2 servers. We observed that the onion C2 server had an expired certificate.

T1090.003Multi-hop ProxyEvidence1

An .onion C2 server address is also hardcoded in the binary and is used as a fallback.

T1105Ingress Tool TransferEvidence2

Impact

1 technique

T1496Resource HijackingEvidence1

What does Watchbog do? The Watchbog botnet mines Monero cryptocurrency for its owners.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

uri●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

intezer blogNews

Jan 1, 2026

WatchBog: New BlueKeep Vulnerability Scanner & Linux Exploits - Intezer

talosintelligence otherNews

Sep 11, 2019

Watchbog and the Importance of Patching

zdnet zero dayNews

Jul 25, 2019

US company selling weaponized BlueKeep exploit | ZDNET

A botnet of hijacked Linux servers involved in stealthy crypto-mining operations; its operators added a BlueKeep scanner to identify vulnerable Windows systems for future targeting or resale.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities7

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.