H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Bonadan

[Bonadan](https://attack.mitre.org/software/S0486) is a malicious version of OpenSSH which acts as a custom backdoor. [Bonadan](https://attack.mitre.org/software/S0486) has been active since at least 2018 and combines a new cryptocurrency-mining module with the same credential-stealing module used by the Onderon family of backdoors.(Citation: ESET ForSSHe December 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Bonadan](https://attack.mitre.org/software/S0486) is a malicious version of OpenSSH which acts as a custom backdoor. [Bonadan](https://attack.mitre.org/software/S0486) has been active since at least 2018 and combines a new cryptocurrency-mining module with the same credential-stealing module used by the Onderon family of backdoors.(Citation: ESET ForSSHe December 2018)

Labels

malware
9 recorded

Relationships

uses
to Command and Scripting Interpreter
Technique
uses
to Compromise Host Software Binary
Technique
uses
to Compute Hijacking
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Process Discovery
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
2 external

References

mitre-attack
S0486
open
ESET ForSSHe December 2018
https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance