Bifrost
Aliases: elf.bifrose
- First seen
- 2009-11-01 00:00:00
- Malware type
- backdoor, rat
- Family
- Malware family
- Last IoC activity
- 2026-07-20 09:55:46
- Profile updated
- 2026-07-07 14:22:24
Targeted industries: technology-and-telecommunications government-and-public-sector
Context
Linux version of the bifrose malware that originally targeted Windows platform only. The backdoor has the ability to perform file management, start or end a process, or start a remote shell. The connection is encrypted using a modified RC4 algorithm.
Detection coverage
- 1 YARA rules
Detection rules
- SEKOIA_Backdoor_Lin_Bifrost (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Elf.Bifrost (report)
- jp.security.ntt — En Blacktech 2021 (report)
- twitter.com — 1595553530579890176 (report)
- cyberandramen.net — A Quick Look At Elf Bifrose (report)
- teamt5.org — Technical Analysis On Backdoor Bifrost Of The Chinese Apt Group Huapi (report)
- revolvy.com — Index (report)
- malware-info.blogspot.lu — Bifrost Trojan (report)