Malware

Bonadan

Bonadan is a Linux malware family built by maliciously modifying OpenSSH binaries to implant a backdoor on compromised systems. It is associated with trojanized OpenSSH server software used for covert persistence on internet-exposed Linux hosts. Bonadan has been documented as part of the broader ecosystem of Linux OpenSSH backdoors that provide stealthy access while also supporting credential interception opportunities inherent to tampered SSH components.

Bonadan supports remote shell access by creating bind and reverse shells on infected machines, enabling interactive post-compromise control. It can download additional modules from command-and-control infrastructure, indicating extensibility beyond its core backdoor functionality. The malware performs host reconnaissance by discovering the username under which it is running, identifying the external IP address of the infected host, and using process enumeration via the ps command to look for other cryptocurrency miners already active on the system. Its command-and-control communications can be obfuscated with XOR encryption.

Available reporting also links Bonadan to cryptocurrency-mining functionality, distinguishing it from OpenSSH backdoors focused solely on persistence and credential theft. The family targets Linux systems, especially servers where OpenSSH is commonly deployed and reachable from the internet. Infection vectors for trojanized OpenSSH malware families are often difficult to determine from malware samples alone, but such families are commonly associated with compromised SSH access, brute-force activity, or exploitation of exposed services.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

T1059.001PowerShellEvidence1

Bonadan can create bind and reverse shells on the infected system. Kessel can create a reverse shell... WINERACK can create a reverse shell... P.A.S. Webshell has the ability to create reverse shells with Perl scripts.

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Persistence

2 techniques

T1505.003Web ShellEvidence1

A popular method used by attackers to maintain persistence on compromised Linux servers is to backdoor the OpenSSH server and client already installed.

T1554Compromise Host Software BinaryEvidence1

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence6

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1033System Owner/User DiscoveryEvidence6

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

T1057Process DiscoveryEvidence5

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1219Remote Access ToolsEvidence1

Bonadan can create bind and reverse shells on the infected system. gh0st RAT is able to open a remote shell to execute commands. Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.

T1573Encrypted ChannelEvidence1

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

T1573.001Symmetric CryptographyEvidence1

Impact

1 technique

T1496.001Compute HijackingEvidence1

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that discovers the username of the user running it.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Finds the external IP address of infected hosts.

mitre attack websiteNews

Oct 21, 2021

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Discovers the username of the user running the backdoor.

mitre attack websiteNews

Oct 21, 2021

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Backdoor that identifies the external IP address of an infected host.

+11 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Bonadan