Ebury
- ID
- S0377
- Type
- Malware
- Platforms
- Linux
- Source
- attack.mitre.org
- MITRE last modified
- 21 Sep 2024
Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (.so files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.[1][2][3][4]
Techniques used (21)
- T1008 Fallback Channels
- T1014 Rootkit
- T1020 Automated Exfiltration
- T1027 Obfuscated Files or Information
- T1041 Exfiltration Over C2 Channel
- T1059.004 Unix Shell
- T1059.006 Python
- T1071.004 DNS
- T1129 Shared Modules
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1552.004 Private Keys
- T1553.002 Code Signing
- T1554 Compromise Host Software Binary
- T1556 Modify Authentication Process
- T1556.003 Pluggable Authentication Modules
- T1568.002 Domain Generation Algorithms
- T1573.001 Symmetric Cryptography
- T1574.006 Dynamic Linker Hijacking
- T1685 Disable or Modify Tools
- T1685.004 Disable or Modify Linux Audit System Log