Loading story…
ESET disclosed Linux/Mumblehard, a Linux malware family that reportedly remained active for more than five years while turning compromised servers into spam relays. The malware was described as two Perl-based components—a backdoor and a spamming daemon—hidden behind a custom assembly-language packer designed to obfuscate the Perl source and hinder analysis. Researchers said the operation primarily targeted web servers and abused the trusted reputation of legitimate server IP addresses to improve spam delivery.
After sinkholing one command-and-control domain, ESET observed more than 8,500 unique IP addresses showing Mumblehard-related behavior, including over 3,000 affected machines during the first week of April alone. The company also reported strong links between the malware and Yellsoft, citing overlapping infrastructure and pirated copies of Yellsoft DirectMailer that silently installed the Mumblehard backdoor, suggesting the spam botnet spread in part through trojanized software used on Linux servers.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ESET publicly revealed the Linux/Mumblehard malware family, describing its Perl-based backdoor and spamming daemon, sinkhole observations of more than 8,500 unique IPs, and evidence linking the operation to Yellsoft and pirated DirectMailer copies.
During the first week of April, ESET observed more than 3,000 machines affected by Linux/Mumblehard while monitoring the botnet through a sinkholed command-and-control domain.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET detailed **Mumblehard**, a malware family targeting Linux and BSD servers that installs a backdoor, a spam-sending daemon, and a general-purpose proxy on compromised systems. The malware’s components were largely Perl scripts encrypted and packed inside custom ELF binaries, and researchers said the operation was strongly linked to **Yellsoft**, a company known for bulk-email software marketed as **DirectMailer**. The backdoor contacted hardcoded command-and-control servers every 15 minutes over HTTP, pulled download-and-execute instructions hidden in `Set-Cookie` headers, and returned execution status through a crafted `User-Agent` string. Researchers said the spam module communicated with its controllers using HTTP `POST` traffic over port 25 and supported configurable spam campaigns, with observed activity promoting pharmaceutical products. By sinkholing one backdoor domain, ESET recorded **8,867 unique IP addresses** over seven months, with web servers making up most victims and infections appearing in intermittent waves. The report said likely infection vectors included exploitation of **Joomla** and **WordPress** sites, as well as trojanized pirated copies of Yellsoft’s DirectMailer that silently installed the Mumblehard backdoor and proxy components.
Aug 14, 2026
ESET reported that the **Ebury** Linux malware operation has remained active for more than a decade, compromising roughly **400,000 servers** since 2009 and leaving more than **100,000** still infected as of late 2023. Identified as an **OpenSSH backdoor** and credential stealer, Ebury has continued to evolve from its earlier role in the **Operation Windigo** crimeware ecosystem, where it supported spam, web traffic redirection, exploit-kit delivery, and broader server-side abuse while allowing legitimate services to keep running and delaying detection. Recent Ebury versions added stronger obfuscation, a new **domain generation algorithm (DGA)**, and improved rootkit features, while operators expanded propagation through compromised hosting providers and **adversary-in-the-middle SSH interception** via ARP spoofing inside data centers. The group also broadened monetization beyond spam and redirects to include theft of **credit card and financial data** from HTTP POST traffic and cryptocurrency wallet theft targeting **Bitcoin** and **Ethereum** nodes, showing that a long-running Linux server botnet first exposed during Windigo has adapted into a durable platform for credential theft and financial crime.
Aug 14, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026