Malware

Widdow

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.002Compromise Software Supply ChainEvidence1

Threat actors successfully compromised the software’s update distribution mechanism, deploying a sophisticated, multi-stage payload.

Execution

2 techniques

T1053.003CronEvidence1

One such critical cron job executes ... virt_check.php. This script runs as the root user.

T1059.004Unix ShellEvidence1

The update script did not patch the software; rather, it executed a localized bash/shell payload designed to modify specific PHP files and deploy the secondary malware.

Persistence

4 techniques

T1053.003CronEvidence1

One such critical cron job executes ... virt_check.php. This script runs as the root user.

T1098.004SSH Authorized KeysEvidence1

The payload injects an attacker-controlled Ed25519 SSH key directly into the root user’s authorized_keys file.

T1136.001Local AccountEvidence1

Additionally, the attackers created a local system user named proxyuser.

T1543.002Systemd ServiceEvidence1

The malware creates a systemd service file named java-jre-update.service ... The Restart=always directive ensures that ... systemd will immediately respawn the malware.

Privilege Escalation

3 techniques

T1053.003CronEvidence1

One such critical cron job executes ... virt_check.php. This script runs as the root user.

T1098.004SSH Authorized KeysEvidence1

The payload injects an attacker-controlled Ed25519 SSH key directly into the root user’s authorized_keys file.

T1543.002Systemd ServiceEvidence1

The malware creates a systemd service file named java-jre-update.service ... The Restart=always directive ensures that ... systemd will immediately respawn the malware.

Stealth

3 techniques

T1036MasqueradingEvidence1

The malware creates a systemd service file named java-jre-update.service. The naming convention is specifically designed to blend in with routine system maintenance tasks.

T1497.003Time Based ChecksEvidence1

The bash script creates a one-time marker file at /tmp/.vz_svc_done and a permanent marker at /usr/lib/jvm/.cache/.installed. The injected PHP code checks for the existence of these files before attempting to download the JAR again.

T1564.001Hidden Files and DirectoriesEvidence1

Once executed, it moves itself to a hidden directory structure designed to look like legitimate Java Runtime Environment cache files: /usr/lib/jvm/.cache/jre-runtime.dat.

Discovery

1 technique

T1497.003Time Based ChecksEvidence1

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The malware dynamically resolves its Command and Control (C2) server via the domain connect.ne-rat.xyz.

T1105Ingress Tool TransferEvidence1

The malware downloads a file named widdow.jar from the domain cdn.nerat.cc.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 month ago

ip.v4●●●●●●●●●●●●View more in app1 month ago

domain●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

thecybersecguruNews

Aug 31, 2026

Virtualizor Vulnerability: VPS Host Nodes Exposed to Unauthorized Access | The CyberSec Guru

Java-based remote-access trojan deployed through the malicious Virtualizor update. It runs as root via a disguised systemd service, persists across reboots, dynamically connects to C2 infrastructure, and is accompanied by root SSH-key injection and creation of a proxyuser account.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Widdow

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.002Compromise Software Supply ChainEvidence1

Threat actors successfully compromised the software’s update distribution mechanism, deploying a sophisticated, multi-stage payload.

Execution

2 techniques

T1053.003CronEvidence1

One such critical cron job executes ... virt_check.php. This script runs as the root user.

T1059.004Unix ShellEvidence1

The update script did not patch the software; rather, it executed a localized bash/shell payload designed to modify specific PHP files and deploy the secondary malware.

Persistence

4 techniques

T1053.003CronEvidence1

One such critical cron job executes ... virt_check.php. This script runs as the root user.

T1098.004SSH Authorized KeysEvidence1

The payload injects an attacker-controlled Ed25519 SSH key directly into the root user’s authorized_keys file.

T1136.001Local AccountEvidence1

Additionally, the attackers created a local system user named proxyuser.

T1543.002Systemd ServiceEvidence1

The malware creates a systemd service file named java-jre-update.service ... The Restart=always directive ensures that ... systemd will immediately respawn the malware.

Privilege Escalation

3 techniques

T1053.003CronEvidence1

One such critical cron job executes ... virt_check.php. This script runs as the root user.

T1098.004SSH Authorized KeysEvidence1

The payload injects an attacker-controlled Ed25519 SSH key directly into the root user’s authorized_keys file.

T1543.002Systemd ServiceEvidence1

The malware creates a systemd service file named java-jre-update.service ... The Restart=always directive ensures that ... systemd will immediately respawn the malware.

Stealth

3 techniques

T1036MasqueradingEvidence1

The malware creates a systemd service file named java-jre-update.service. The naming convention is specifically designed to blend in with routine system maintenance tasks.

T1497.003Time Based ChecksEvidence1

T1564.001Hidden Files and DirectoriesEvidence1

Once executed, it moves itself to a hidden directory structure designed to look like legitimate Java Runtime Environment cache files: /usr/lib/jvm/.cache/jre-runtime.dat.

Discovery

1 technique

T1497.003Time Based ChecksEvidence1

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The malware dynamically resolves its Command and Control (C2) server via the domain connect.ne-rat.xyz.

T1105Ingress Tool TransferEvidence1

The malware downloads a file named widdow.jar from the domain cdn.nerat.cc.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 month ago

ip.v4●●●●●●●●●●●●View more in app1 month ago

domain●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

thecybersecguruNews

Aug 31, 2026

Virtualizor Vulnerability: VPS Host Nodes Exposed to Unauthorized Access | The CyberSec Guru

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.