MITRE ATT&CKsoftware (malware)
S0430 Winnti for Linux
- Domain
- enterprise
- Platforms
- Linux
- Version
- 1.1
- Created
- 2020-04-29
Description
Winnti for Linux is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including Winnti Group. The Windows variant is tracked separately under Winnti for Windows.
Related
Uses · MITRE ATT&CK (8)
- T1027.013 Encrypted/Encoded File sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1205 Traffic Signaling technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1014 Rootkit technique
- T1095 Non-Application Layer Protocol technique
- T1105 Ingress Tool Transfer technique
References
- https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a Chronicle Winnti for Linux May 2019