Threat intelligence / Malware

Winnti for Linux

[Winnti for Linux](https://attack.mitre.org/software/S0430) is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including [Winnti Group](https://attack.mitre.org/groups/G0044). The Windows variant is tracked separately under [Winnti for Windows](https://attack.mitre.org/software/S0141).(Citation: Chronicle Winnti for Linux May 2019)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Winnti for Linux](https://attack.mitre.org/software/S0430) is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including [Winnti Group](https://attack.mitre.org/groups/G0044). The Windows variant is tracked separately under [Winnti for Windows](https://attack.mitre.org/software/S0141).(Citation: Chronicle Winnti for Linux May 2019)

Labels

malware

11 recorded

Relationships

uses

from APT41

Group

uses

from Aquatic Panda

Group

uses

from Earth Lusca

Group

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Non-Application Layer Protocol

Technique

uses

Technique

uses

to Symmetric Cryptography

Technique

uses

to Traffic Signaling

Technique

uses

to Web Protocols

Technique

2 external

References

mitre-attack

S0430

Chronicle Winnti for Linux May 2019

https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a