Loading story…
XOR.DDoS has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch SYN flood, ACK flood, and DNS amplification attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, Groundhog, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign.
The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a loadable kernel module rootkit to hide processes and TCP ports, and survive reboots through files and scripts placed in /boot, /etc/init.d, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the Tsunami backdoor and XMRig miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In July 2015, Check Point's Incident Response team investigated a customer's Linux-based DNS BIND server after suspicious file activity was observed. Check Point determined the server had been compromised through an SSH brute-force attack earlier that month, with attackers gaining root access within a few days.
Check Point reported that Groundhog had not been previously reported and assessed with high probability that Groundhog and XOR.DDoS were different modules of the same malware family created by the same actor. The report also noted attackers had shifted brute-force infrastructure from a HEE THAI LIMITED netblock to CHINANET Jiangsu province backbone.
MalwareMustDie! reported the Linux DDoS malware family XOR.DDoS at the end of September 2014. Later reporting also described the malware as first discovered in 2014 by MalwareMustDie.
Microsoft reported a 254% increase in observed XorDdos activity over the previous six months. Its analysis described continued SSH brute-force propagation, rootkit-enabled stealth, persistence mechanisms, and post-infection deployment of additional malware such as Tsunami and XMRig on some devices.
Avast analyzed XOR.DDoS as a Linux botnet malware family used for DDoS attacks, detailing SSH brute-force access, tailored installation, persistence, and an embedded loadable kernel module rootkit. The analysis also documented ARM support, a newer 32-bit variant, and file-based indicators of compromise.
Check Point's forensic analysis found files related to the Groundhog malware were created on day 36 of the observed 2015 attack timeline. The compromise ultimately involved both XOR.DDoS and the previously unreported Groundhog malware.
Check Point's forensic analysis found files related to XOR.DDoS were created on day 12 of the observed 2015 attack timeline. This marked deployment of the XOR.DDoS payload on the compromised Linux server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
fireeye.com
Open sourcemicrosoft.com
Open sourcebartblaze.blogspot.com
Open sourceblog.avast.com
Open sourceblog.malwaremustdie.org
Open sourceblog.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026
Researchers reported that **Kaiji** and **XORDDoS** operators were actively compromising Linux infrastructure to expand botnets used for distributed denial-of-service attacks. Trend Micro observed both malware families targeting exposed Docker servers through the unauthenticated Docker API on port `2375`: XORDDoS enumerated running containers on vulnerable hosts and executed commands inside each one to download and launch its payload, while Kaiji scanned for exposed Docker instances, validated targets, and deployed a rogue ARM container that fetched and ran the malware. The activity showed two distinct propagation models aimed at the same weakly secured container environments. Separate analysis of Kaiji found the malware was a **Golang-based** Linux and IoT botnet with assessed Chinese origins, built from scratch rather than derived from Mirai or BillGates. Researchers said Kaiji also spread through **SSH brute forcing**, targeted the `root` account, installed itself under disguised filenames, and supported DDoS functions, shell command execution, C2 replacement, self-deletion, and Linux persistence. It also attempted lateral movement by abusing local SSH keys and IP addresses recovered from bash history and known-hosts data, although researchers assessed the operation as relatively immature because its infrastructure was short-lived and parts of the code appeared unfinished.
Aug 14, 2026
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026