Skip to content

Windigo

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.

ATT&CK ID: G0124
Techniques: 7
Tools: 1

Techniques

Initial Access

Drive-by Compromise

Execution

Command and Scripting Interpreter

Discovery

System Information Discovery File and Directory Discovery Software Discovery

Collection

Data from Local System

Command and Control

Software

Ebury

MITRE ATT&CK All threat actors