Sockbot
- Malware type
- backdoor
- Profile updated
- 2026-07-07 14:41:38
Context
Sockbot is a customized and in Go written fork of the Ligolo reverse tunneling open-source tool. Several modification were performed by the threat actors who rewrote that code, e.g. execution checks, hardcoded values. Ligolo: https://github.com/sysdream/ligolo
Reports & references
- Cisco Talos — Iranian Supergroup Muddywater (report)
- secjoes-reports.s3.eu-central-1.amazonaws.com — Sockbot%2Bin%2Bgoland (report)
- bleepingcomputer.com — Hackers Fork Open Source Reverse Tunneling Tool For Persistence (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Sockbot (report)
- youtube.com — Watch (report)