Windigo compromises Linux and Unix servers using the Ebury SSH backdoor to build spam botnets.
The Windigo group has been active since at least 2011, compromising Linux and Unix servers using the Ebury SSH backdoor. It primarily targets server infrastructure to build spam botnets and steal credentials. Key TTPs include Drive-by Compromise for initial access, Command and Scripting Interpreter for execution, and Data from Local System for collection; Ebury malware is used to backdoor SSH and maintain persistence with Proxy for C2. Defenders should monitor SSH daemons for unauthorized modifications, inspect shared memory for hidden backdoors, and enforce strict credential hygiene.
The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.
Implement web traffic monitoring and user education to detect and mitigate suspicious Drive-by Compromise activity.
Monitor Command and Scripting Interpreters for unusual usage and implement restrictive policies to limit suspicious script execution.
Monitor system and application logs to detect System Information Discovery and Software Discovery, and limit suspicious queries.
Monitor file and folder access to detect Data from Local System collection, and restrict access to sensitive data.
Monitor network traffic to detect and mitigate suspicious Proxy activity, and limit unusual network behavior.
The Windigo group compromises Linux and Unix servers using the Ebury SSH backdoor.
The group maintains persistence by backdooring SSH with the Ebury malware and uses Proxy for C2 communication.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.