MITRE ATT&CKsoftware (malware)
S0641 Kobalos
- Domain
- enterprise
- Platforms
- Linux
- Version
- 1.0
- Created
- 2021-08-24
Description
Kobalos is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. Kobalos has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. Kobalos was first identified in late 2019.
Related
Uses · MITRE ATT&CK (15)
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1059.004 Unix Shell sub-technique
- T1554 Compromise Host Software Binary technique
- T1070.003 Clear Command History sub-technique
- T1070.006 Timestomp sub-technique
- T1205 Traffic Signaling technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1048 Exfiltration Over Alternative Protocol technique
- T1056 Input Capture technique
- T1074 Data Staged technique
- T1082 System Information Discovery technique