Loading story…
ESET reported that the Ebury Linux malware operation has remained active for more than a decade, compromising roughly 400,000 servers since 2009 and leaving more than 100,000 still infected as of late 2023. Identified as an OpenSSH backdoor and credential stealer, Ebury has continued to evolve from its earlier role in the Operation Windigo crimeware ecosystem, where it supported spam, web traffic redirection, exploit-kit delivery, and broader server-side abuse while allowing legitimate services to keep running and delaying detection.
Recent Ebury versions added stronger obfuscation, a new domain generation algorithm (DGA), and improved rootkit features, while operators expanded propagation through compromised hosting providers and adversary-in-the-middle SSH interception via ARP spoofing inside data centers. The group also broadened monetization beyond spam and redirects to include theft of credit card and financial data from HTTP POST traffic and cryptocurrency wallet theft targeting Bitcoin and Ethereum nodes, showing that a long-running Linux server botnet first exposed during Windigo has adapted into a durable platform for credential theft and financial crime.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
On 2024-05-14, ESET reported that Ebury had compromised about 400,000 Linux servers since 2009 and had expanded beyond spam and traffic redirection into credit card and cryptocurrency theft. The report also detailed propagation through compromised hosting providers and theft from Bitcoin and Ethereum nodes.
As of late 2023, ESET reported that more than 100,000 servers were still compromised by Ebury. This showed the botnet remained active and extensive years after Operation Windigo.
A major Ebury update, version 1.8, was first seen in late 2023. ESET said it introduced stronger obfuscation, a new domain generation algorithm, and improved rootkit capabilities.
In 2023, internet telemetry indicated that more than 200 servers were targeted by Ebury operators using adversary-in-the-middle SSH interception attacks inside data centers. The attackers used compromised servers in the same network segment to perform ARP spoofing and capture credentials.
In 2021, the Dutch National High Tech Crime Unit contacted ESET after finding Ebury on the server of a cryptocurrency theft victim. The two organizations then worked together to gain visibility into the group's recent activity and malware.
On 2014-10-15, ESET said the Windigo gang's malicious activity had not decreased since its March 2014 report and that Ebury had been updated to evade detection. The update also described technical changes in newer Ebury versions and noted CERT-Bund had refreshed its IOC page based on ESET's findings.
Within a month of ESET's March 2014 publication, ESET observed a new Ebury version that evaded the indicators of compromise it had published. The update showed the operators reacted quickly to public research.
ESET first saw Ebury version 1.4.1 in April 2014, showing the malware was continuing to evolve after the March 2014 Windigo report. This marked an early post-disclosure update in the malware's development.
In March 2014, ESET published its Operation Windigo report describing a profit-driven malware ecosystem involving more than 10,000 infected servers worldwide, with Ebury as an OpenSSH backdoor component. The report tied together credential theft, web traffic redirection, exploit-kit delivery, and spam monetization.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcewelivesecurity.com
Open sourceweb-assets.esetstatic.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Linux/SSHDoor.A**, a trojanized OpenSSH daemon that steals usernames and passwords from compromised Linux servers while giving attackers covert persistent access. The malware exfiltrates server and credential data over HTTP after encrypting it with an embedded **1024-bit RSA** key and Base64-encoding the result, and it can preserve access through a hardcoded password or bundled SSH key, with override options read from `/var/run/.options`. ESET linked the activity to infrastructure including **`openssh.info`** and **`linuxrepository.org`**, which at the time resolved to **`82.221.99.69`**, and a later sample shared publicly was detected by multiple antivirus engines as an SSH backdoor. The SSH backdoor was also observed alongside **Linux/Chapro.A**, a malicious Apache module used to inject iframes into web traffic, delivering a Java exploit for **`CVE-2012-1723`** and ultimately a **Zeus/Zbot** payload to Windows victims. In later research, ESET expanded the picture beyond SSHDoor, identifying **21** undocumented or underdocumented Linux malware families built from trojanized OpenSSH binaries; **18** stole credentials and **17** provided stealth backdoor access. The findings showed that OpenSSH backdoors remained an active and diverse threat on Linux servers, ranging from simple credential theft to more advanced families using encrypted HTTP, raw TCP, or DNS for command and control.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026