Loading story…
Researchers identified Godlua, a Lua-based backdoor for Linux and Windows, as one of the first malware strains observed abusing DNS over HTTPS (DoH) to hide command-and-control activity. The malware was linked in part to exploitation of Atlassian Confluence vulnerability CVE-2019-3396 on unpatched servers, and some early samples were initially mislabeled as cryptocurrency miners before investigators tied them to distributed denial-of-service activity. Netlab reported that Godlua had already been used in attacks, including HTTP flood operations targeting liuxiaobei.com.
Godlua uses a layered, redundant control architecture that pulls staged payloads and C2 data from hardcoded domains, GitHub, Pastebin, DNS TXT records, and encrypted DoH queries, reducing visibility for tools that rely on passive DNS monitoring. Researchers said the malware downloads files disguised as PNG images, decrypts them with AES-CBC, loads modified Lua bytecode directly into memory, and then executes commands that support shell access, file execution, upgrades, proxying, and further Lua-based attack logic. The use of DoH to retrieve TXT-record-based C2 locations marked a notable escalation in malware tradecraft because it can blend malicious DNS lookups into normal encrypted web traffic.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Qihoo 360's Netlab published a report describing Godlua as the first malware observed abusing DNS over HTTPS to retrieve command-and-control information from DNS TXT records. The report also linked at least some Linux infections to exploitation of Atlassian Confluence vulnerability CVE-2019-3396.
Google announced support for DNS over HTTPS on its public DNS service in the month before Netlab's report. The article cites this as part of the broader adoption of DoH by major internet platforms.
Netlab documented active Godlua versions ranging from 20190415103713 to 20190621174731, showing the malware was being actively updated. The newer branch supported both Linux and Windows and expanded command capabilities.
360 Netlab's Unknown Threat Detection System highlighted a suspicious ELF file that researchers identified as the Lua-based Godlua Backdoor. Some antivirus vendors initially labeled it as mining-related, but researchers observed DDoS behavior instead.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Threat actors abused GitHub to distribute malware by cloning legitimate repositories, impersonating trusted open-source projects, and poisoning search results to steer victims to trojanized downloads. One campaign spoofed the **AIMMY** game-cheat project through a cloned repository and the lookalike site `aimmy.app`, while also exploiting GitHub's issue-draft upload behavior to host malicious files on the original benign repository via direct links that appeared trustworthy. The delivered packages included files such as `Aimmy.bat`, `AimmyLauncher.exe`, `lua51.dll`, and supporting data, with the malware implemented through obfuscated **LuaJIT** code. Follow-on analysis tied similar GitHub repo poisoning activity to **SmartLoader**, which used trojanized `lua51.dll` components and heavily obfuscated Lua payloads to deploy **StealC** infostealer. The malware performed anti-debugging and anti-tamper checks, captured screenshots, verified connectivity and geolocation, and fetched additional payloads from attacker-controlled GitHub repositories. Researchers found it also used the **EtherHiding** technique, querying the Polygon PoS blockchain for dynamically updated command-and-control data, before exfiltrating browser credentials, cookies, cryptocurrency wallet information, and email data to attacker infrastructure including `213.176.72[.]200`.
Aug 15, 2026
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of **`CVE-2018-8174`**, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced **`mshtml.dll`** to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed **SLUB**. Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a **GitHub Gist**, sent execution results to private **Slack** channels using embedded API tokens, and uploaded stolen files to **file.io**. Trend Micro said the downloader also checked for antivirus processes and exploited **`CVE-2015-1701`** for local privilege escalation, while the backdoor persisted via a Run registry key and **`rundll32.exe`**. The operation appeared focused on collecting person-related information and communications data, including content from **Skype**, **KakaoTalk**, **Twitter**, bulletin board systems, and **HWP** documents; GitHub and Slack removed the malicious infrastructure after notification.
Aug 15, 2026