Glupteba
- First seen
- 2011-12-01 00:00:00
- Malware type
- botnet, credential-stealer, cryptominer, trojan
- Family
- Malware family
- Last IoC activity
- 2026-07-22 00:38:33
- Profile updated
- 2026-07-07 13:23:44
Targeted industries: financial-services technology-and-telecommunications
Context
Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Glupteba_Auto (yara-rule)
Reports & references
- ESET — Operation Windigo The Vivisection Of A Large Linux Server Side Credential Stealing Malware Campaign (report)
- intezer.com — Intezer 2020 Go Malware Round Up (report)
- thehackernews.com — Over 200000 Microtik Routers Worldwide (report)
- decoded.avast.io — Meris And Trickbot Standing On The Shoulders Of Giants (report)
- blog.sekoia.io — Privateloader The Loader Of The Prevalent Ruzki Ppi Service (report)
- bitdefender.com — Bitdefender Pr Whitepaper Mosaicloader Creat5540 En En (report)
- community.riskiq.com — Description (report)
- domaintools.com — Identifying Network Infrastructure Related To A Who Spoofing Campaign (report)
- medium.com — Installcapital When Adware Becomes Pay Per Install Cyber Crime 15516249A451 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Glupteba (report)
- ESET — Glupteba No Longer Windigo (report)
- blog.google — Disrupting Glupteba Operation (report)
- dissectingmalwa.re — The Blame Game About False Flags And Overwritten Mbrs (report)
- resources.infosecinstitute.com — Tdss4 Part 1 (report)
- nakedsecurity.sophos.com — Glupteba The Bot That Gets Secret Messages From The Bitcoin Blockchain (report)
- Trend Micro — Ransomware Operators Found Using New Franchise Business Model (report)
- nozominetworks.com — Tracking Malicious Glupteba Activity Through The Blockchain (report)
- news.sophos.com — Glupteba Report (report)
- blog.google — New Action Combat Cyber Crime (report)
- blog.chainalysis.com — 2022 Crypto Crime Report Preview Malware (report)
- ESET — Tdl4 And Glubteba Piggyback Piggybugs (report)
- storage.googleapis.com — 1 Complaint (report)
- Trend Micro — Glupteba Campaign Hits Network Routers And Updates Cc Servers With Data From Bitcoin Transactions (report)
- labs.k7computing.com (report)
- virusbulletin.com — Vb2022 Uncovering A Broad Criminal Ecosystem Powered By One Of The Largest Botnets Glupteba (report)