G0124 Windigo
Enterprisealso known asWindigo
The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.
01
canonical actor
The group this is attributed to.
02
techniques used (7)
ATT&CK techniques this enables or maps to.
03
software used (1)
Malware and tools associated with this.
04
source
Where this definition is published.