Kobalos

MITRE ATT&CK: S0641 View on attack.mitre.org

Aliases: Kobalos

First seen
2019-12-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
linux
Related IoCs
1 (1 malicious)
Last IoC activity
2025-06-05 17:19:24
Profile updated
2026-07-07 14:26:38

Targeted industries: education-and-nonprofits technology-and-telecommunications

Context

Kobalos is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. Kobalos has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. Kobalos was first identified in late 2019.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to Kobalos (S0641). The 1 most recently updated:

TypeIndicatorUpdatedSources
file sample Zvernennya.docx.lnk 2025-06-05 1

Detection coverage

  • 4 YARA rules
  • 191 Sigma rules

Malware & tools used

  • Unix Shell (attack-pattern)
  • Compromise Host Software Binary (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Clear Command History (attack-pattern)
  • Data Staged (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Traffic Signaling (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Exfiltration Over Alternative Protocol (attack-pattern)
  • Timestomp (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Input Capture (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Multi-hop Proxy (attack-pattern)

Detection rules

  • SIGNATURE_BASE_APT_MAL_LNX_Kobalos (yara-rule)
  • SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer (yara-rule)
  • ESET_Kobalos (yara-rule)
  • ESET_Kobalos_Ssh_Credential_Stealer (yara-rule)

Reports & references

  • malpedia.caad.fkie.fraunhofer.de — Elf.Kobalos (report)
  • ESET — Kobalos Complex Linux Threat High Performance Computing Infrastructure (report)
  • team-cymru.com — Kobalos Malware Mapping (report)
  • ESET — Eset Kobalos (report)
  • ESET — Eset Threat Report T12021 (report)
  • MITRE ATT&CK — S0641 (report)

External references