Loading malware…
XorDDoS is a Linux malware family active since 2014 that compromises servers and other Linux-based systems to build botnets for distributed denial-of-service attacks. It is commonly described as a Linux trojan or bot and is named for its use of XOR-obfuscated communications and its primary role in DDoS operations. The malware has remained active for years, has spread globally, and has also been observed targeting exposed Docker environments in addition to conventional Linux hosts.
A well-documented initial access vector is SSH brute-forcing. After obtaining valid credentials, operators deploy shell scripts or ELF payloads that install the malware, establish persistence, and in some cases tailor the infection to the victim’s kernel environment. XorDDoS commonly persists through init scripts, cron jobs, and System V runlevel links, and may copy itself into common system directories while disguising process names and modifying binaries to hinder detection and hash-based tracking. Anti-forensic behavior has included clearing shell history and overwriting log files.
A notable feature of XorDDoS is optional rootkit support on Linux. Variants have used or installed loadable kernel module components derived from or inspired by open-source rootkit projects such as Suterusu and Rooty. These components can hide processes, ports, network connections, and the malware’s kernel module, and can provide stealth and privileged access on infected systems. Some installation workflows query the victim kernel version and module metadata to obtain or build a compatible rootkit remotely.
XorDDoS communicates with command-and-control infrastructure using a hard-coded XOR key and supports commands for system profiling, downloading or updating payloads, stopping or starting attack activity, and retrieving process-kill configuration. Its DDoS functionality includes high-volume flooding techniques such as SYN flood, ACK flood, and DNS-based attacks. The malware also gathers host information including operating system and hardware characteristics. Some campaigns have shown infected systems later receiving additional malware, indicating that XorDDoS infections can serve broader post-compromise objectives beyond DDoS alone.
The family has been linked in multiple analyses to Chinese-speaking operators or infrastructure, and code or tooling relationships have been noted with other Linux malware including Groundhog and RedXOR. Reporting has also identified source-code or author overlap between XorDDoS rootkit components and later Linux malware such as Krasue. Overall, XorDDoS is a long-running Linux botnet malware family distinguished by SSH-based compromise, durable persistence, rootkit-enabled defense evasion, and sustained use in large-scale DDoS operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We uncovered key similarities between RedXOR and previously reported malware associated with Winnti umbrella threat group. These malware are PWNLNX backdoor and XOR.DDOS and Groundhog, two botnets attributed to Winnti by BlackBerry.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
• (AS2) /etc/cron.<S>/, where S is a period (hourly, daily, monthly, weekly). Additionally, a service might be added to run in the cron (/etc/crontab).
This is done by creating symbolic links or executable scripts in the following directories: • (AS1) /etc/init.d/ ... • (AS2) /etc/cron.<S>/ ... • (AS3) /etc/rc<N>.d/
The malware creates a symlink for the init script dropped at the location /etc/init.d/<base_file_name> with the directories associated with runlevels 1 through 5 at /etc/rc<run_level>.d/S90<base_file_name>.
• (AS2) /etc/cron.<S>/, where S is a period (hourly, daily, monthly, weekly). Additionally, a service might be added to run in the cron (/etc/crontab).
Once XorDdos identifies valid SSH credentials, it uses root privileges to run a script that downloads and installs XorDdos on the target device.
This is done by creating symbolic links or executable scripts in the following directories: • (AS1) /etc/init.d/ ... • (AS2) /etc/cron.<S>/ ... • (AS3) /etc/rc<N>.d/
The malware creates a symlink for the init script dropped at the location /etc/init.d/<base_file_name> with the directories associated with runlevels 1 through 5 at /etc/rc<run_level>.d/S90<base_file_name>.
• (AS2) /etc/cron.<S>/, where S is a period (hourly, daily, monthly, weekly). Additionally, a service might be added to run in the cron (/etc/crontab).
The rootkit component with a complicated server-assisted installation is where Xorddos differs from all the other Linux trojans.
The C&C communication is encrypted in both directions with the same hard-coded XOR key (BB2FA36AAA9541F0) – which inspired the trojan’s name.
A bot running this type of execution is called as the /usr/bin/bsd-port/getty file.
The installation process can consist of several steps: • killing competing time-consuming processes
Once XorDdos identifies valid SSH credentials, it uses root privileges to run a script that downloads and installs XorDdos on the target device.
Distribution starts with either an automated SSH brute-forcing of various Windows and Linux servers or vulnerability scanning and exploiting using the hacking tools and password lists mentioned below.
The bash script gets the target device’s kernel-related information... lsmod ... Modinfo extracts the vermagic number... The tcp_thread... sends details of the device such as the magic string, OS release version, malware version, rootkit presence, memory stats, CPU information, and LAN speed.
The bot then establishes communication with its C&C server. The initial packet contains the memory and CPU statistics of the compromised machine.
Three requests are issued to hard-coded C&C servers: the initial GET with an MD5-hashed string containing the name of the kernel version; a GET query with the parameters of a customized binary such as rootkit version and a list of the bot’s C&Cs; and the final GET request of a compiled binary.
108 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named Linux botnet malware family included in the report tags related to SSH server attacks.
Mentioned only as previously associated implant activity on IPs involved in the first DDoS attack; the report does not connect it directly to Zhadnost or attribute the campaign to it.
Linux malware associated with persistence and scheduled task abuse; the content references it as relevant to cron-based persistence detection on Unix-like systems.
Associated Analytic Story China-Nexus Threat Activity ... Salt Typhoon ... XorDDos
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.