MalwareUsed by 1 actor

Fysbis

Fysbis is a modular Linux backdoor used by Sofacy, also known as APT28 or Sednit, in cyberespionage operations. It forms part of the Russia-linked group's tooling for compromising Linux systems; Sofacy's broader targeting includes government and defense organizations, particularly in Eastern Europe. Fysbis implements plug-in and controller modules as distinct classes and exists as both 32-bit and 64-bit ELF binaries, with analyzed samples dating from late 2014 through late 2015.

The malware supports remote shell functionality, keylogging, discovery of running processes, and file deletion. It can install and establish persistence with or without root privileges, allowing operation under an ordinary user account. It disguises itself as legitimate synchronization, desktop notification, or system services. Fysbis communicates with command-and-control infrastructure and can Base64-encode its traffic. Later analyzed variants use a rolling double-XOR algorithm to obfuscate installation details and command-and-control configuration. Its relatively simple implementation nevertheless provides effective remote access and surveillance capabilities on compromised Linux systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT28

Drovorub, Fysbis, Downdelph, ADVSTORESHELL

via cyfirma blogcyfirma.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.004Unix ShellEvidence2

Persistence

2 techniques

T1543.002Systemd ServiceEvidence2

T1547.013XDG Autostart EntriesEvidence2

Privilege Escalation

2 techniques

T1543.002Systemd ServiceEvidence2

T1547.013XDG Autostart EntriesEvidence2

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence2

...the most recent ELF 64-bit binary... demonstrated minor evolution of the threat, most notably in terms of obfuscation... the referenced byte mask is applied to the other byte arrays using a rolling double-XOR algorithm to construct malware installation paths, filenames, and descriptions... The same masking method is also used by the binary to decode malware configuration C2 information...

T1027.013Encrypted/Encoded FileEvidence2

T1036MasqueradingEvidence3

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.004Masquerade Task or ServiceEvidence2

T1036.005Match Legitimate Resource Name or LocationEvidence2

T1070.004File DeletionEvidence4

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1497.001System ChecksEvidence1

...we can see the binary installation path and local reconnaissance to determine which flavor of Linux the malware is running.

Credential Access

1 technique

T1056.001KeyloggingEvidence3

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Discovery

4 techniques

T1057Process DiscoveryEvidence5

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence7

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.

T1083File and Directory DiscoveryEvidence5

Examples in the content include 'XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed' and 'Fysbis has used the command ls /etc | egrep ... to determine which Linux OS version is running.'

T1497.001System ChecksEvidence1

...we can see the binary installation path and local reconnaissance to determine which flavor of Linux the malware is running.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Figure 3: Sofacy Fysbis stripped binary string references to RemoteShell capability ... Figure 4: Sofacy Fysbis non-stripped binary strings referenes to RemoteShell capability

Collection

1 technique

T1056.001KeyloggingEvidence3

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence2

C2 azureon-line[.]com (TCP/80) ... 198.105.125[.]74 (TCP/80) ... mozilla-plugins[.]com (TCP/80) | C2 azureon-line[.]com (TCP/80) ... C2 198.105.125[.]74 (TCP/80) ... C2 mozilla-plugins[.]com (TCP/80) ... The oldest sample... was found to beacon to the domain azureon-line[.]com... The first of the newer samples... beacons to an IP also widely associated with the Sofacy group... The newest sample... introduces a previously unknown command and control beacon to mozilla-plugins[.]com.

T1132Data EncodingEvidence2

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence2

T1219Remote Access ToolsEvidence1

For comparison, if we were to inspect Fysbis “RemoteShell” associated strings...

INDICATORS OF COMPROMISE

IOCs tracked for this family

15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha1●●●●●●●●●●●●View more in app10 years ago

hash.md5●●●●●●●●●●●●View more in app10 years ago

ACTIVITY FEED

Recent activity

27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

27 SOURCESView more in app

cyfirma blogNews

Jul 16, 2025

APT PROFILE - FANCY BEAR - CYFIRMA

Drovorub, Fysbis, Downdelph, ADVSTORESHELL

mitre attack websiteNews

Oct 21, 2021

Masquerading: Match Legitimate Name or Location, Sub-technique T1036.005 - Enterprise | MITRE ATT&CK®

Malware that impersonates trusted Linux software components.

mitre attack websiteNews

Oct 21, 2021

Indicator Removal on Host: File Deletion, Sub-technique T1070.004 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of deleting files.

mitre attack websiteNews

Oct 21, 2021

Data Encoding: Standard Encoding, Sub-technique T1132.001 - Enterprise | MITRE ATT&CK®

Malware that can Base64-encode command-and-control traffic.

+21 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching15

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Fysbis