Elknot

Elknot is a long-running Linux-focused DDoS bot family, also referred to in some reporting as Setag, Mayday, or BillGates depending on variant and lineage. It is associated with ELF malware ecosystems targeting Linux, Unix-like systems, and embedded devices, and has been observed as one of the most prevalent malware families in that space. The family has supported multiple architectures and operating systems across variants, including Linux x86 and x86_64, Windows x86 and x64, and FreeBSD, while some reporting notes that core Elknot activity mainly targeted x86 systems.

Elknot is primarily used to build botnets for distributed denial-of-service operations. Documented attack capabilities include HTTP flood, TCP packet attacks, DNS flood, DNS amplification, ICMP flood, TCP SYN flood, and UDP flood, as well as custom DNS random-subdomain attack techniques. Variants implement command handling for starting and stopping attacks, updating modules, and executing shell commands. Some Setag-linked variants also include stronger backdoor behavior, encrypted configuration handling, and anti-analysis or anti-rival features.

The family has evolved through multiple versions. A simpler Elknot form has been described as a patcher or dropper that installs a bot and carries encrypted command-and-control configuration. Setag variants expose multiple execution modes and have been observed establishing persistence through startup scripts and runlevel links. Some samples replace common administrative utilities with copies of themselves while preserving originals elsewhere, indicating defense evasion and post-compromise control. Configuration protection has been reported using RSA-based and XOR-like schemes, while command-and-control protocol continuity across variants suggests a stable operational design despite substantial code changes.

Observed infection vectors for Elknot-associated botnets include SSH brute-force compromise and exploitation of exposed services such as MySQL and Elasticsearch. In broader Linux botnet operations, attackers have also used vulnerability scanning, brute-force tooling, and automated installation frameworks to deploy ELF DDoS malware families including Elknot. The malware has been used both directly as a bot and as a delivery component for other malware; one documented campaign used an Elknot dropper to deliver the Chalubo bot package.

Operational reporting links Elknot/BillGates activity to large-scale DDoS campaigns affecting tens of thousands of victims, with command-and-control infrastructure and victim concentration especially notable in China and the United States. Targeted sectors have included online gaming, e-commerce, online casinos, and other internet-facing services, with financial extortion assessed as a likely motive in parts of the ELF DDoS ecosystem. Elknot remains notable for its longevity, prevalence, and adaptability within Linux botnet operations.