Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The source file, opsproxy.c, reveals a purpose-built reverse proxy that quietly grafts attacker-controlled content onto a compromised web server.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
The Bash installer compiles and installs opsproxy.c using apxs, wiring the malicious module into Apache configuration.
The installer enables proxy, headers, and rewrite modules, installs the malicious module, tests configuration, and restarts Apache.
The installer deletes source and build artifacts, then timestomps the malicious .so and load-configuration files to match legitimate Apache modules.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.