Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Windigo · Unknown · mitre-attack · refreshed 2026-10-06

Windigo

MITRE G0124 ↗

Windigo — ATT&CK roseWI

attack rose · 7 techniques across 5 tactics

Analyst brief

mitre-attack

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

7 techniques · 5 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    1 technique

  3. Discovery

    3 techniques

  4. Collection

    1 technique

  5. Command and control

    1 technique

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
EburyS0377 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

3 sources
  1. 1.attack.mitre.org/groups/G0124
  2. 2.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-larg…
  3. 3.security.web.cern.ch/advisories/windigo/windigo.shtml

Track Windigo on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.