Loading malware…
Ebury is a Linux-focused OpenSSH backdoor and credential-stealing malware family at the core of the long-running Operation Windigo ecosystem. First observed in 2011 and active for many years afterward, it has compromised large numbers of internet-facing servers worldwide, especially hosted Linux systems. Ebury is designed to maintain covert access to compromised servers, intercept SSH credentials, and provide operators with persistent remote access while minimizing disruption to legitimate server activity.
Ebury commonly persists by trojanizing OpenSSH-related components and libraries, especially through malicious modifications to libkeyutils and, in some cases, patched OpenSSH client or server binaries. Newer variants use LD_PRELOAD-based loading and a persistent helper process for state management and credential exfiltration, communicating internally over abstract UNIX sockets. The malware includes userland rootkit functionality to hide malicious processes, files, sockets, and mapped memory from administrators and investigators.
Its primary functionality includes harvesting login credentials handled by SSH services and clients, collecting system information, and enabling backdoor access through specially crafted SSH client identification strings sent before key exchange. Ebury operators have been observed connecting regularly to infected systems to retrieve stolen credentials and host data. The malware also supports encrypted and encoded command-and-control and exfiltration traffic, including hexadecimal or Base64-encoded activation data depending on version, and has used DNS-based exfiltration, HTTP or HTTPS POST requests, and domain generation algorithms as resilient command-and-control or fallback mechanisms.
Later versions introduced stronger obfuscation, revised DGA logic, and improved rootkit behavior. Ebury has also been associated with broader criminal monetization beyond credential theft, including botnet operations, spam, web traffic redirection, theft of financial data from web transactions, and cryptocurrency theft from compromised servers. The malware has been linked to a criminal enterprise that used stolen server credentials to build a large botnet of compromised servers globally.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
Senakh admitted that he supported the criminal enterprise by creating accounts with domain registrars which helped build the Ebury botnet infrastructure
allowing Senakh and his co-conspirators to create and operate a botnet comprising tens of thousands of infected servers throughout the world
We’ve seen that the servers we’ve fixed have been misused for distribution of malware, SPAM and, in some cases, to steal credit cards on compromised web servers used for e-commerce.
One can use the following command to determine if the server he is on is compromised: ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected" | At the time of writing, the following command starts a shell free from the Ebury rootkit: H=1 LD_DEBUG="" LD_PRELOAD="" "$SHELL"
Trojanized sshd, ssh, ssh-add and the target of the libkeyutils.so.1 symbolic link.
Ebury uses an abstract UNIX socket to communicate with an external process that will be responsible for data exfiltration.
Trojanized sshd, ssh, ssh-add and the target of the libkeyutils.so.1 symbolic link. | Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version... Patching libkeyutils.so to load libXXX.so instead of the libc.so.6 library.
Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version.
The permanently running process listening to this UNIX socket is started by loading the Ebury payload into a legitimate executable using LD_PRELOAD. | Since Ebury inject itself using the dynamic linker LD_PRELOAD environment variable... If libkeyutils is loaded in some process where it shouldn’t be, it is very likely that the system is infected with a rootkit-enabled version of Ebury.
Senakh and his co-conspirators used the Ebury botnet to generate and redirect internet traffic in furtherance of various click-fraud and spam e-mail schemes
To determine whether a system is compromised by Ebury, make sure you do so from a trusted shell. At the time of writing, the following command starts a shell free from the Ebury rootkit: | In case your machine is infected with an Ebury version with the userland rootkit...
An SSH connection enabling the Ebury backdoor contains hexadecimal-encoded data (for Ebury before version 1.7) or base64-encoded data (for Ebury version 1.7 and later, first seen in 2019). Since version 1.8, spaces are ignored.
The permanently running process listening to this UNIX socket is started by loading the Ebury payload into a legitimate executable using LD_PRELOAD. Abused legitimate processes include: /bin/hostname, /bin/sync, /sbin/auditd, /sbin/rsyslogd... | Abused legitimate processes include: /bin/hostname, /bin/sync, /sbin/auditd, /sbin/rsyslogd, /sbin/udevd...
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
Senakh and his co-conspirators used the Ebury botnet to generate and redirect internet traffic in furtherance of various click-fraud and spam e-mail schemes
Trojanized sshd, ssh, ssh-add and the target of the libkeyutils.so.1 symbolic link. | Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version... Patching libkeyutils.so to load libXXX.so instead of the libc.so.6 library.
Replacing libkeyutils.so, a library loaded by OpenSSH, with a trojanized version.
The permanently running process listening to this UNIX socket is started by loading the Ebury payload into a legitimate executable using LD_PRELOAD. | Since Ebury inject itself using the dynamic linker LD_PRELOAD environment variable... If libkeyutils is loaded in some process where it shouldn’t be, it is very likely that the system is infected with a rootkit-enabled version of Ebury.
HTTP POST requests made to, and from, the servers are leveraged to steal financial details from transactional websites.
the malware, which is known as Ebury, harvested log-on credentials from infected computer servers
Ebury starts a process to keep state information and perform credential exfiltration... Ebury operators are known to connect daily to compromised systems using the Ebury backdoor to retrieve stolen credentials.
Another interesting method is the use of adversary in the middle to intercept SSH traffic of interesting targets inside data centers and redirect it to a server used to capture credentials.
Among the targets are Bitcoin and Ethereum nodes. Ebury automatically steals cryptocurrency wallets hosted on the targeted server once the victim types the password to log into it.
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
The Ebury backdoor is activated by including specific information in the SSH client identification string... An SSH connection enabling the Ebury backdoor contains hexadecimal-encoded data... or base64-encoded data. | The Ebury backdoor is activated by including specific information in the SSH client identification string... Since it is sent before the SSH handshake and key exchange are performed, it is unencrypted.
APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.
Ebury operators are known to connect daily to compromised systems using the Ebury backdoor to retrieve stolen credentials and system information such as known hosts and users who last connected to the system. | The following domains are used to exfiltrate HTTP POST requests over HTTP or HTTPS.
The following domains are used to exfiltrate HTTP POST requests over HTTP or HTTPS.
To find the server to send this data to, a DNS request is made for the TXT record of a subdomain... The IP address is decrypted from the TXT record. | Linux/Onimiki is a DNS server backdoor. These rules will alert on either inbound or outbound DNS requests with the specific Linux/Cdorked URL pattern... Since Perl/Calfbot uses HTTPS... these rules will match specific DNS requests.
Senakh and his co-conspirators used the Ebury botnet to generate and redirect internet traffic in furtherance of various click-fraud and spam e-mail schemes
To find the server to send this data to, a DNS request is made for the TXT record of a subdomain of one of the following domains... First domain of the sixth iteration of the DGA. | First domain of the sixth iteration of the DGA... First domain of the fifth iteration of the DGA... Below is the list of domains generated by the DGA for each seed by DGA generation.
123 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
OpenSSH credential-stealing backdoor for Linux servers; referenced here as a rival implant the framework can detect and terminate.
Linux malware mentioned as abusing PAM-related authentication mechanisms to establish persistence, capture credentials, and maintain unauthorized access.
Ebury is identified in the content as a botnet being propagated.
A Linux server-side malware family that backdoors OpenSSH, steals credentials, hides itself with a userland rootkit, and is used at scale to compromise servers for financial gain including cryptocurrency theft, credit card/financial data theft, spam, and web traffic redirection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.