Loading malware…
Win32/Glubteta.M is a generic Windows proxy malware referenced in connection with the Windigo operation. The provided content states that Windigo delivered Win32/Glubteta.M as a generic Windows proxy, indicating that its primary known capability is to function as a proxy on infected Windows systems. No additional high-confidence details about its infection vector, persistence, specific command-and-control protocol, targeted industries, or indicators of compromise are provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Windigo has delivered a generic Windows proxy Win32/Glubteta.M.
1 distinct technique documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows proxy malware delivered as part of Windigo operations.
Windows proxy malware delivered as part of Windigo activity.
Proxy-capable malware/botnet component used to provide Windows proxying functionality.
Windows proxy/botnet malware used to provide proxying capability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.