Loading malware…
Linux/Onimiki is a Linux DNS server backdoor associated with Operation Windigo, a large profit-driven server compromise ecosystem active since at least 2011. It targets systems already running the BIND DNS server and modifies DNS resolution behavior so that specially crafted domain-name patterns can be resolved to attacker-chosen IP addresses without requiring visible changes to normal server-side DNS configuration. This capability allowed compromised DNS infrastructure to support malicious traffic routing and other monetization activity within the broader Windigo operation.
Within Windigo, Linux/Onimiki operated alongside other components including Linux/Ebury, an OpenSSH backdoor and credential stealer; Linux/Cdorked, a web redirection backdoor; and Perl/Calfbot, a spam bot. The broader campaign primarily expanded through stolen credentials rather than exploitation of new Linux vulnerabilities, and monetized access through spam distribution, malicious redirections, and drive-by malware delivery. Linux/Onimiki specifically functioned as a covert DNS manipulation component on Linux DNS servers serving legitimate requests, enabling attacker-controlled name resolution while blending into otherwise normal DNS service activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
The following domains are used to exfiltrate HTTP POST requests over HTTP or HTTPS.
Linux/Onimiki is a DNS server backdoor. These rules will alert on either inbound or outbound DNS requests with the specific Linux/Cdorked URL pattern. | Linux/Onimiki is a DNS server backdoor. These rules will alert on either inbound or outbound DNS requests with the specific Linux/Cdorked URL pattern... Since Perl/Calfbot uses HTTPS... these rules will match specific DNS requests.
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux/Onimiki is a trojanized BIND/named DNS server backdoor associated with Windigo. It modifies the named binary and enables malicious DNS-related activity on already active DNS servers.
A patched BIND DNS backdoor used in the Windigo infrastructure to resolve specially crafted subdomains to attacker-chosen IP addresses, supporting Linux/Cdorked traffic redirection while blending into legitimate authoritative DNS service.
A patched BIND DNS backdoor used in the Windigo infrastructure to resolve specially crafted subdomains to attacker-chosen IP addresses, supporting Linux/Cdorked traffic redirection while blending into legitimate authoritative DNS service.
Linux/Onimiki is a trojanized BIND/named DNS server backdoor associated with Windigo. It modifies the named binary and enables malicious DNS-related activity on already active DNS servers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.