Loading malware…
MIGLOGCLEANER is an ELF anti-forensics utility for Linux and Unix-based systems that wipes selected logs or removes specified strings from log records. It enables attackers to selectively alter logging evidence and obscure traces of activity on compromised hosts. Its source code is publicly available on GitHub.
MIGLOGCLEANER has been used by UNC2891, a financially motivated threat actor targeting banking and ATM infrastructure. It forms part of the actor’s broader toolkit for concealing intrusions, alongside backdoors, credential-stealing tools, and other log-cleaning utilities. Its established role is log manipulation and defense evasion rather than initial access or transaction manipulation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MIGLOGCLEANER utility provides an attacker with an ability to clean or tamper specified logs in an anti-forensics way.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Log-wiping component used to erase logs and reduce detection/attribution.
Log-cleaning utility used to erase or alter Linux logs and shell history, removing entire records or selected entries according to specified criteria. UNC2891 disguised its files as legitimate shared libraries to reduce detection and obstruct forensic reconstruction.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.