Windigo
MITRE ATT&CK: G0124 View on attack.mitre.org
Aliases: Windigo
- First seen
- 2011-01-01 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Related IoCs
- 35 (3 malicious)
- Last IoC activity
- 2026-10-16 00:42:33
- Profile updated
- 2026-07-07 12:30:44
Targeted industries: technology-and-telecommunications media-and-entertainment
Context
The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.
Recent IoC activity
3 malicious indicators in Maltiverse are attributed to Windigo (G0124). The 3 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 171f60c9f73ab592d41bd157753577dcf2b417f5491bb0a994d9c914b75c6aaa | 2026-10-08 | 1 |
| file sample | 9ec1292db28fcb8b844ebc5dac9da228bbef4674b2c2cd46817800aedb6a66cb | 2026-10-08 | 1 |
| file sample | mu-311020.exe | 2026-09-24 | 1 |
Detection coverage
- 1 YARA rules
- 167 Sigma rules
Malware & tools used
- System Information Discovery (attack-pattern)
- Data from Local System (attack-pattern)
- Software Discovery (attack-pattern)
- Proxy (attack-pattern)
- Command and Scripting Interpreter (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Drive-by Compromise (attack-pattern)
- Ebury (malware)
Reports & references
- MITRE ATT&CK — G0124 (report)
- security.web.cern.ch — Windigo.Shtml (report)
- ESET — Operation Windigo The Vivisection Of A Large Linux Server Side Credential Stealing Malware Campaign (report)