MalwareUsed by 1 actor

Groundhog

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT41

We uncovered key similarities between RedXOR and previously reported malware associated with Winnti umbrella threat group. These malware are PWNLNX backdoor and XOR.DDOS and Groundhog, two botnets attributed to Winnti by BlackBerry.

via intezer blogintezer.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The malware has the ability to download additional modules, and perform remote code execution via reverse shell

T1059.004Unix ShellEvidence1

One of the following shells is used: /bin/bash /bin/sh

Persistence

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

After installing the binary to the hidden folder, the malware sets up persistence via “init” scripts. The following files are created after executing the malware on boot: /usr/syno/etc/rc.d/S99po1kitd-update.sh /etc/init.d/po1kitd-update /etc/rc2.d/S99po1kitd-update

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Privilege Escalation

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Stealth

2 techniques

T1070.004File DeletionEvidence1

The malware executes the copied file without arguments, removes its own executable file from the hard drive

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Credential Access

1 technique

T1110.001Password GuessingEvidence1

The source of this compromise was traced to an SSH brute force attack that took place earlier the same month.

Discovery

3 techniques

T1046Network Service DiscoveryEvidence1

netstat -an netstat -antop

T1057Process DiscoveryEvidence1

The malware enumerates all currently running processes using this folder: /proc/

T1082System Information DiscoveryEvidence1

Collect information about the system state and send it to the specified URL.

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

The C&C messages data section is encrypted using a simple XOR cipher

T1071Application Layer ProtocolEvidence1

The entire C&C communication occurs via HTTP protocol using TCP/3053 or TCP/6001.

T1090.003Multi-hop ProxyEvidence1

the hosts issuing the attack were themselves compromised and unwillingly recruited to conduct a DDoS campaign.

T1095Non-Application Layer ProtocolEvidence1

The C&C communication occurs via a custom binary protocol.

T1105Ingress Tool TransferEvidence1

Download and execute a file from the specified URL.

Impact

2 techniques

T1489Service StopEvidence1

Once the information is retrieved, these processes are killed by the malware.

T1498Network Denial of ServiceEvidence1

These payloads were the XOR.DDoS and Groundhog malware variants, which are specifically designed to infect Linux-based hosts and force them to participate in large DDoS attack campaigns.

INDICATORS OF COMPROMISE

IOCs tracked for this family

216 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

215 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app6 months ago

ip.v4●●●●●●●●●●●●View more in app11 years ago

domain●●●●●●●●●●●●View more in app11 years ago

domain●●●●●●●●●●●●View more in app12 years ago

domain●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

intezer blogNews

Jan 1, 2026

Linux Backdoor RedXOR Likely Operated by Chinese Nation-State

Botnet malware referenced as a related Winnti-associated family used for comparison with RedXOR, particularly around persistence naming conventions using prefixed service names under rc.d.

checkpoint blogNews

Aug 14, 2026

Linux ELF backdoor used to maintain persistent access to infected servers. It communicates with C2 over multiple common TCP ports, can download and execute additional modules, perform reverse shell remote code execution, kill processes, collect system and process information, and appears tightly coupled with XOR.DDoS.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching216

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Groundhog

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT41

via intezer blogintezer.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The malware has the ability to download additional modules, and perform remote code execution via reverse shell

T1059.004Unix ShellEvidence1

One of the following shells is used: /bin/bash /bin/sh

Persistence

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Privilege Escalation

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Stealth

2 techniques

T1070.004File DeletionEvidence1

The malware executes the copied file without arguments, removes its own executable file from the hard drive

T1078Valid AccountsEvidence1

Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.

Credential Access

1 technique

T1110.001Password GuessingEvidence1

The source of this compromise was traced to an SSH brute force attack that took place earlier the same month.

Discovery

3 techniques

T1046Network Service DiscoveryEvidence1

netstat -an netstat -antop

T1057Process DiscoveryEvidence1

The malware enumerates all currently running processes using this folder: /proc/

T1082System Information DiscoveryEvidence1

Collect information about the system state and send it to the specified URL.

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

The C&C messages data section is encrypted using a simple XOR cipher

T1071Application Layer ProtocolEvidence1

The entire C&C communication occurs via HTTP protocol using TCP/3053 or TCP/6001.

T1090.003Multi-hop ProxyEvidence1

the hosts issuing the attack were themselves compromised and unwillingly recruited to conduct a DDoS campaign.

T1095Non-Application Layer ProtocolEvidence1

The C&C communication occurs via a custom binary protocol.

T1105Ingress Tool TransferEvidence1

Download and execute a file from the specified URL.

Impact

2 techniques

T1489Service StopEvidence1

Once the information is retrieved, these processes are killed by the malware.

T1498Network Denial of ServiceEvidence1

These payloads were the XOR.DDoS and Groundhog malware variants, which are specifically designed to infect Linux-based hosts and force them to participate in large DDoS attack campaigns.

INDICATORS OF COMPROMISE

IOCs tracked for this family

216 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

215 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app6 months ago

ip.v4●●●●●●●●●●●●View more in app11 years ago

domain●●●●●●●●●●●●View more in app11 years ago

domain●●●●●●●●●●●●View more in app12 years ago

domain●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

intezer blogNews

Jan 1, 2026

Linux Backdoor RedXOR Likely Operated by Chinese Nation-State

Botnet malware referenced as a related Winnti-associated family used for comparison with RedXOR, particularly around persistence naming conventions using prefixed service names under rc.d.

checkpoint blogNews

Aug 14, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching216

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.