Threat intelligence / Malware

Kobalos

[Kobalos](https://attack.mitre.org/software/S0641) is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. [Kobalos](https://attack.mitre.org/software/S0641) has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. [Kobalos](https://attack.mitre.org/software/S0641) was first identified in late 2019.(Citation: ESET Kobalos Feb 2021)(Citation: ESET Kobalos Jan 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Kobalos](https://attack.mitre.org/software/S0641) is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. [Kobalos](https://attack.mitre.org/software/S0641) has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. [Kobalos](https://attack.mitre.org/software/S0641) was first identified in late 2019.(Citation: ESET Kobalos Feb 2021)(Citation: ESET Kobalos Jan 2021)

Labels

malware

15 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Clear Command History

Technique

uses

to Compromise Host Software Binary

Technique

uses

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Exfiltration Over Alternative Protocol

Technique

uses

to Input Capture

Technique

uses

to Multi-hop Proxy

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

to Traffic Signaling

Technique

uses

Technique

4 external

References

mitre-attack

S0641

Kobalos

—

ESET Kobalos Feb 2021

https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/

ESET Kobalos Jan 2021

https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf