Loading story…
ESET detailed Mumblehard, a malware family targeting Linux and BSD servers that installs a backdoor, a spam-sending daemon, and a general-purpose proxy on compromised systems. The malware’s components were largely Perl scripts encrypted and packed inside custom ELF binaries, and researchers said the operation was strongly linked to Yellsoft, a company known for bulk-email software marketed as DirectMailer. The backdoor contacted hardcoded command-and-control servers every 15 minutes over HTTP, pulled download-and-execute instructions hidden in Set-Cookie headers, and returned execution status through a crafted User-Agent string.
Researchers said the spam module communicated with its controllers using HTTP POST traffic over port 25 and supported configurable spam campaigns, with observed activity promoting pharmaceutical products. By sinkholing one backdoor domain, ESET recorded 8,867 unique IP addresses over seven months, with web servers making up most victims and infections appearing in intermittent waves. The report said likely infection vectors included exploitation of Joomla and WordPress sites, as well as trojanized pirated copies of Yellsoft’s DirectMailer that silently installed the Mumblehard backdoor and proxy components.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
ESET's sinkhole collection period ended on April 22, 2015. Over the observation window, the company recorded 8,867 unique IP addresses contacting the sinkhole, with an outage between December 7, 2014 and January 6, 2015.
ESET sinkholed one of the Mumblehard backdoor domains and began collecting telemetry from infected hosts. The collection period documented infected systems contacting the sinkhole and supported later victim-count analysis.
ESET reported that Mumblehard had been active since at least 2009, based on samples submitted to VirusTotal. This establishes the earliest known timeframe for the malware operation.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET disclosed **Linux/Mumblehard**, a Linux malware family that reportedly remained active for more than five years while turning compromised servers into spam relays. The malware was described as two Perl-based components—a **backdoor** and a **spamming daemon**—hidden behind a custom assembly-language packer designed to obfuscate the Perl source and hinder analysis. Researchers said the operation primarily targeted web servers and abused the trusted reputation of legitimate server IP addresses to improve spam delivery. After sinkholing one command-and-control domain, ESET observed more than **8,500 unique IP addresses** showing Mumblehard-related behavior, including over **3,000 affected machines** during the first week of April alone. The company also reported strong links between the malware and **Yellsoft**, citing overlapping infrastructure and pirated copies of **Yellsoft DirectMailer** that silently installed the Mumblehard backdoor, suggesting the spam botnet spread in part through trojanized software used on Linux servers.
Aug 14, 2026
ESET reported that the **Ebury** Linux malware operation has remained active for more than a decade, compromising roughly **400,000 servers** since 2009 and leaving more than **100,000** still infected as of late 2023. Identified as an **OpenSSH backdoor** and credential stealer, Ebury has continued to evolve from its earlier role in the **Operation Windigo** crimeware ecosystem, where it supported spam, web traffic redirection, exploit-kit delivery, and broader server-side abuse while allowing legitimate services to keep running and delaying detection. Recent Ebury versions added stronger obfuscation, a new **domain generation algorithm (DGA)**, and improved rootkit features, while operators expanded propagation through compromised hosting providers and **adversary-in-the-middle SSH interception** via ARP spoofing inside data centers. The group also broadened monetization beyond spam and redirects to include theft of **credit card and financial data** from HTTP POST traffic and cryptocurrency wallet theft targeting **Bitcoin** and **Ethereum** nodes, showing that a long-running Linux server botnet first exposed during Windigo has adapted into a durable platform for credential theft and financial crime.
Aug 14, 2026
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of **`CVE-2018-8174`**, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced **`mshtml.dll`** to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed **SLUB**. Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a **GitHub Gist**, sent execution results to private **Slack** channels using embedded API tokens, and uploaded stolen files to **file.io**. Trend Micro said the downloader also checked for antivirus processes and exploited **`CVE-2015-1701`** for local privilege escalation, while the backdoor persisted via a Run registry key and **`rundll32.exe`**. The operation appeared focused on collecting person-related information and communications data, including content from **Skype**, **KakaoTalk**, **Twitter**, bulletin board systems, and **HWP** documents; GitHub and Slack removed the malicious infrastructure after notification.
Aug 15, 2026