MITRE ATT&CKgroup

G0124 Windigo

Published 2021-02-10 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2021-02-10

Description

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.

Related

Uses · MITRE ATT&CK (8)

  • T1518 Software Discovery technique
  • S0377 Ebury software (malware)
  • T1189 Drive-by Compromise technique
  • T1005 Data from Local System technique
  • T1059 Command and Scripting Interpreter technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1090 Proxy technique

References