LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0021: Derusbi

Derusbi is malware used by multiple Chinese APT groups.[1][2] Both Windows and Linux variants have been observed.[3]

EnterpriseS0021MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S0021: Derusbi describes [Derusbi](https://attack.mitre.org/software/S0021) is malware used by multiple Chinese APT groups.(Citation: Novetta-Axiom)(Citation: ThreatConnect Anthem) Both Windows and Linux variants have been observed.(Citation: Fidelis Turbo)

Executive priority

S0021: Derusbi is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0021: Derusbi by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows, Linux), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S0021: Derusbi appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Derusbi

Derusbi is malware used by multiple Chinese APT groups.[1][2] Both Windows and Linux variants have been observed.[3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1056.001KeyloggingSub-technique

Derusbi is capable of logging keystrokes.[4]

EnterpriseT1059.004Unix ShellSub-technique

Derusbi is capable of creating a remote Bash shell and executing commands.[3][4]

EnterpriseT1218.010Regsvr32Sub-technique

Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.CitationThreatGeek Derusbi Converge

EnterpriseT1082System Information Discovery

Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.[3]

EnterpriseT1070.006TimestompSub-technique

The Derusbi malware supports timestomping.[1][3]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Derusbi injects itself into the secure shell (SSH) process.CitationAirbus Derusbi 2015

EnterpriseT1070.004File DeletionSub-technique

Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.[3][4]

EnterpriseT1571Non-Standard Port

Derusbi has used unencrypted HTTP on port 443 for C2.[3]

EnterpriseT1573.001Symmetric CryptographySub-technique

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.[3]

EnterpriseT1033System Owner/User Discovery

A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.[3]

EnterpriseT1123Audio Capture

Derusbi is capable of performing audio captures.[4]

EnterpriseT1083File and Directory Discovery

Derusbi is capable of obtaining directory, file, and drive listings.[3][4]

EnterpriseT1008Fallback Channels

Derusbi uses a backup communication method with an HTTP beacon.[3]

EnterpriseT1095Non-Application Layer Protocol

Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.[3]

EnterpriseT1113Screen Capture

Derusbi is capable of performing screen captures.[4]

EnterpriseT1125Video Capture

Derusbi is capable of capturing video.[4]

EnterpriseT1057Process Discovery

Derusbi collects current and parent process IDs.[3][4]

EnterpriseT1012Query Registry

Derusbi is capable of enumerating Registry keys and values.[4]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

GroupEnterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

GroupEnterprise

G0001: Axiom

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]

GroupEnterprise

G0009: Deep Panda

Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. [1] The intrusion into healthcare company Anthem has been attributed to Deep Panda. [2] This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. [3] Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. [4] Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. [5]

Relationship explorer

All related ATT&CK context

uses · GroupG0096: APT41Enterpriseuses · GroupG0065: LeviathanEnterpriseuses · GroupG0001: AxiomEnterpriseuses · GroupG0009: Deep PandaEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1012: Query RegistryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.2
Created
Modified
Raw hash
8e508ebe623622d1...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.2Current bundle8e508ebe6236…
19.11.2Older bundle8e508ebe6236…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  2. [2]
    ThreatConnect Anthem

    ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016.

    Open source URL
  3. [3]
    Fidelis Turbo

    Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.

    Open source URL
  4. [4]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  5. [5]
    Derusbi

    (Citation: Novetta-Axiom)

  6. [6]
    PHOTO

    (Citation: FireEye Periscope March 2018)

  7. [7]
    mitre-attackS0021
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use