S0486 Bonadan

malwareEnterprise

platformsLinux

also known asBonadan

Bonadan is a malicious version of OpenSSH which acts as a custom backdoor. Bonadan has been active since at least 2018 and combines a new cryptocurrency-mining module with the same credential-stealing module used by the Onderon family of backdoors.

techniques used (9)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1059Command and Scripting Interpreter
T1082System Information Discovery
T1105Ingress Tool Transfer
T1496.001Compute Hijacking
T1554Compromise Host Software Binary
T1573.001Symmetric Cryptography

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan