Threat intelligence / Malware

Ebury

[Ebury](https://attack.mitre.org/software/S0377) is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by [Windigo](https://attack.mitre.org/groups/G0124). [Ebury](https://attack.mitre.org/software/S0377) is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, [Ebury](https://attack.mitre.org/software/S0377) has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.(Citation: ESET Ebury Feb 2014)(Citation: BleepingComputer Ebury March 2017)(Citation: ESET Ebury Oct 2017)(Citation: ESET Ebury May 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Ebury](https://attack.mitre.org/software/S0377) is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by [Windigo](https://attack.mitre.org/groups/G0124). [Ebury](https://attack.mitre.org/software/S0377) is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, [Ebury](https://attack.mitre.org/software/S0377) has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.(Citation: ESET Ebury Feb 2014)(Citation: BleepingComputer Ebury March 2017)(Citation: ESET Ebury Oct 2017)(Citation: ESET Ebury May 2024)

Labels

malware

22 recorded

Relationships

uses

to Automated Exfiltration

Technique

uses

to Code Signing

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Linux Audit System Log

Technique

uses

to Disable or Modify Tools

Technique

uses

to DNS

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Dynamic Linker Hijacking

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Fallback Channels

Technique

uses

to Modify Authentication Process

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Pluggable Authentication Modules

Technique

uses

to Private Keys

Technique

uses

Technique

uses

Technique

uses

to Shared Modules

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

Technique

uses

Group

6 external

References

mitre-attack

S0377

Ebury

—

BleepingComputer Ebury March 2017

https://www.bleepingcomputer.com/news/security/russian-hacker-pleads-guilty-for-role-in-infamous-linux-ebury-malware/

ESET Ebury Feb 2014

https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/

ESET Ebury May 2024

https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf

ESET Ebury Oct 2017

https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/