Glupteba

First seen
2011-12-01 00:00:00
Malware type
botnet, credential-stealer, cryptominer, trojan
Family
Malware family
Last IoC activity
2026-07-22 00:38:33
Profile updated
2026-07-07 13:23:44

Targeted industries: financial-services technology-and-telecommunications

Context

Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.

Detection coverage

  • 1 YARA rules

Detection rules

  • MALPEDIA_Win_Glupteba_Auto (yara-rule)

Reports & references

  • ESET — Operation Windigo The Vivisection Of A Large Linux Server Side Credential Stealing Malware Campaign (report)
  • intezer.com — Intezer 2020 Go Malware Round Up (report)
  • thehackernews.com — Over 200000 Microtik Routers Worldwide (report)
  • decoded.avast.io — Meris And Trickbot Standing On The Shoulders Of Giants (report)
  • blog.sekoia.io — Privateloader The Loader Of The Prevalent Ruzki Ppi Service (report)
  • bitdefender.com — Bitdefender Pr Whitepaper Mosaicloader Creat5540 En En (report)
  • community.riskiq.com — Description (report)
  • domaintools.com — Identifying Network Infrastructure Related To A Who Spoofing Campaign (report)
  • medium.com — Installcapital When Adware Becomes Pay Per Install Cyber Crime 15516249A451 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Glupteba (report)
  • ESET — Glupteba No Longer Windigo (report)
  • blog.google — Disrupting Glupteba Operation (report)
  • dissectingmalwa.re — The Blame Game About False Flags And Overwritten Mbrs (report)
  • resources.infosecinstitute.com — Tdss4 Part 1 (report)
  • nakedsecurity.sophos.com — Glupteba The Bot That Gets Secret Messages From The Bitcoin Blockchain (report)
  • Trend Micro — Ransomware Operators Found Using New Franchise Business Model (report)
  • nozominetworks.com — Tracking Malicious Glupteba Activity Through The Blockchain (report)
  • news.sophos.com — Glupteba Report (report)
  • blog.google — New Action Combat Cyber Crime (report)
  • blog.chainalysis.com — 2022 Crypto Crime Report Preview Malware (report)
  • ESET — Tdl4 And Glubteba Piggyback Piggybugs (report)
  • storage.googleapis.com — 1 Complaint (report)
  • Trend Micro — Glupteba Campaign Hits Network Routers And Updates Cc Servers With Data From Bitcoin Transactions (report)
  • labs.k7computing.com (report)
  • virusbulletin.com — Vb2022 Uncovering A Broad Criminal Ecosystem Powered By One Of The Largest Botnets Glupteba (report)

External references