S0430 Winnti for Linux

malwareEnterprise

platformsLinux

also known asWinnti for Linux

Winnti for Linux is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including Winnti Group. The Windows variant is tracked separately under Winnti for Windows.

techniques used (8)

ATT&CK techniques this enables or maps to.

T1014Rootkit
T1027.013Encrypted/Encoded File
T1071.001Web Protocols
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1205Traffic Signaling
T1573.001Symmetric Cryptography

used by groups (3)

Threat groups associated with this.

G0096APT41
G0143Aquatic Panda
G1006Earth Lusca

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan