Sindoor
- First seen
- 2019-12-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Profile updated
- 2026-07-07 14:30:03
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:in country_code:pk
Context
Sindoor is a remote access trojan (RAT) known for its use in cyber-espionage campaigns, particularly targeting organizations in South Asia. It provides attackers with access and control over compromised systems.
Detection coverage
- 4 YARA rules
Detection rules
- SIGNATURE_BASE_SUSP_LNX_Sindoor_ELF_Obfuscation_Aug25 (yara-rule)
- SIGNATURE_BASE_SUSP_LNX_Sindoor_Desktopfile_Aug25 (yara-rule)
- SIGNATURE_BASE_MAL_Sindoor_Decryptor_Aug25 (yara-rule)
- SIGNATURE_BASE_MAL_Sindoor_Downloader_Aug25 (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Elf.Sindoor (report)
- nextron-systems.com — Sindoor Dropper New Phishing Campaign (report)