MITRE ATT&CKsoftware (malware)
S0377 Ebury
- Domain
- enterprise
- Platforms
- Linux
- Version
- 2.0
- Created
- 2019-04-19
Description
Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.
Related
Uses · MITRE ATT&CK (21)
- T1685 Disable or Modify Tools technique
- T1685.004 Disable or Modify Linux Audit System Log sub-technique
- T1556.003 Pluggable Authentication Modules sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.004 DNS sub-technique
- T1132.001 Standard Encoding sub-technique
- T1574.006 Dynamic Linker Hijacking sub-technique
- T1568.002 Domain Generation Algorithms sub-technique
- T1059.004 Unix Shell sub-technique
- T1059.006 Python sub-technique
- T1554 Compromise Host Software Binary technique
- T1556 Modify Authentication Process technique
- T1553.002 Code Signing sub-technique
- T1552.004 Private Keys sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1008 Fallback Channels technique
- T1014 Rootkit technique
- T1020 Automated Exfiltration technique
- T1027 Obfuscated Files or Information technique
- T1041 Exfiltration Over C2 Channel technique
- T1129 Shared Modules technique
Referenced by MITRE ATT&CK · uses (1)
- G0124 Windigo group
References
- https://www.bleepingcomputer.com/news/security/russian-hacker-pleads-guilty-for-role-in-infamous-linux-ebury-malware/ BleepingComputer Ebury March 2017
- https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/ ESET Ebury Feb 2014
- https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf ESET Ebury May 2024
- https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/ ESET Ebury Oct 2017