EvilGnome
- First seen
- 2019-07-01 00:00:00
- Malware type
- spyware, trojan
- Last IoC activity
- 2026-05-21 06:48:48
- Profile updated
- 2026-07-07 13:46:34
Targeted industries: government-and-public-sector
Context
According to Infosec Institute, EvilGnome presents itself to unwitting Linux users as a legitimate GNOME extension. Legitimate extensions help to extend Linux functionality, but instead of a healthy boost in system functionality, EvilGnome begins spying on users with an array of functionalities uncommon for most Linux malware types.
Reports & references
- intezer.com — Elf Malware Analysis 101 Linux Threats No Longer An Afterthought (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Evilgnome (report)
- intezer.com — Blog Evilgnome Rare Malware Spying On Linux Desktop Users (report)
- ssu.gov.ua — Technical%20Report%20Armagedon (report)
- cocomelonc.github.io — Linux Hacking 3 (report)