LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0341: Xbash

Xbash is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks. Xbash was developed in Python and then converted into a self-contained Linux ELF executable by using PyInstaller.[1]

EnterpriseS0341MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Xbash matters because it represents server-focused malware spanning Linux and Windows, with ATT&CK relationships that cover discovery, credential guessing, persistence, command-and-control, tool transfer, and impact behaviors such as data destruction or encryption. For leaders, the decision point is not a single signature for Xbash; it is whether server monitoring, identity controls, egress visibility, and recovery readiness are strong enough to handle malware that can move from discovery into operational disruption.

Executive priority

Prioritize Xbash as a resilience and server-security validation case. The supplied ATT&CK context links it to Linux and Windows servers and to techniques associated with password guessing, scheduled or startup persistence, web-based C2, ingress tool transfer, and destructive/encryption impact. Executives should ask whether critical servers have enforceable credential protections, monitored administrative scripting, controlled outbound web access, tested backups, and incident response playbooks that cover both Linux and Windows recovery evidence.

Technical view

ATT&CK provides no official detection text for Xbash, so SOC and IR teams should validate coverage through the related techniques rather than rely on a named-malware analytic. On Linux, confirm visibility into cron changes, process execution, network/service discovery, file transfer activity, outbound web connections, and suspicious ELF execution, including PyInstaller-style self-contained binaries where observable. On Windows, confirm telemetry for PowerShell, Visual Basic/JScript execution paths, mshta.exe and regsvr32.exe proxy execution, Registry Run Keys/Startup Folder changes, password guessing signals, and outbound web/dead-drop style resolver behavior. Because the object is malware targeting Linux and Microsoft Windows servers, detection engineering should test server telemetry specifically, not only endpoint workstations.

Likely telemetry

  • Linux process execution and command-line telemetry
  • Windows process creation and command-line telemetry
  • PowerShell execution logs where enabled
  • Script execution evidence for Visual Basic, JScript/JavaScript, mshta.exe, and regsvr32.exe
  • Cron/crontab file and job modification events

Detection direction

  • Build detection around the mapped ATT&CK techniques: T1016, T1046, T1053.003, T1059.001, T1059.005, T1059.007, T1071.001, T1102.001, T1105, T1110.001, T1203, T1218.005, T1218.010, T1485, T1486, and T1547.001.
  • Tune separately for Linux and Windows servers; workstation-focused detections may miss cron persistence, Linux ELF execution, or server-to-server discovery patterns.
  • Baseline legitimate administration before alerting on discovery commands, scripting engines, or scheduled tasks, since many related behaviors overlap with normal operations.
  • Correlate weak signals: password guessing followed by scripting execution, tool transfer, persistence changes, outbound web traffic, and data modification is more meaningful than any single event.
  • Validate egress monitoring for ordinary web protocols and legitimate web services used as resolvers, because ATT&CK notes C2 may blend into common HTTP/S-style traffic.

Mitigation priorities

  • Sequence controls around server resilience: harden exposed services, reduce unnecessary network services, and ensure vulnerability management covers server applications relevant to client-execution exploitation risk.
  • Strengthen identity defenses against password guessing with strong password policy, lockout/rate-limiting where appropriate, and monitoring of repeated authentication failures.
  • Restrict and monitor administrative scripting and living-off-the-land execution paths, including PowerShell, mshta.exe, regsvr32.exe, Visual Basic/JScript, and Linux cron usage.
  • Limit outbound server internet access to business-required destinations and inspect web-protocol traffic where policy and architecture allow.
  • Protect persistence locations such as cron entries, Registry Run Keys, and Startup Folders with change monitoring and least-privilege administration.
Additional notes and limits

The strongest decision value in this object comes from the relationship set: Xbash is connected to discovery, execution, persistence, credential access, command-and-control, ingress transfer, and impact techniques. The official description states it targeted Linux and Microsoft Windows servers, was developed in Python, converted to a Linux ELF using PyInstaller, and has been tied to Iron Group, a group known for previous ransomware attacks. Treat attribution as source context, not as a basis for assuming current activity or exposure.

ATT&CK provides no official detection guidance for this object, and the object-level tactics are not specified. The relationship descriptions are technique-level context and may include platforms beyond Xbash’s stated Windows and Linux scope; local validation is required before claiming coverage. This take does not assert active exploitation, customer exposure, or guaranteed detection.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Xbash

Xbash is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks. Xbash was developed in Python and then converted into a self-contained Linux ELF executable by using PyInstaller.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

16 rows
DomainIDNameRelationship / procedure
EnterpriseT1071.001Web ProtocolsSub-technique

Xbash uses HTTP for C2 communications.[1]

EnterpriseT1485Data Destruction

Xbash has destroyed Linux-based databases as part of its ransomware capabilities.[1]

EnterpriseT1059.005Visual BasicSub-technique

Xbash can execute malicious VBScript payloads on the victim’s machine.[1]

EnterpriseT1218.005MshtaSub-technique

Xbash can use mshta for executing scripts.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Xbash can create a Startup item for persistence if it determines it is on a Windows system.[1]

EnterpriseT1053.003CronSub-technique

Xbash can create a cronjob for persistence if it determines it is on a Linux system.[1]

EnterpriseT1203Exploitation for Client Execution

Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.[1][2]

EnterpriseT1105Ingress Tool Transfer

Xbash can download additional malicious files from its C2 server.[1]

EnterpriseT1059.001PowerShellSub-technique

Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.[1]

EnterpriseT1059.007JavaScriptSub-technique

Xbash can execute malicious JavaScript payloads on the victim’s machine.[1]

EnterpriseT1046Network Service Discovery

Xbash can perform port scanning of TCP and UDP ports.[1]

EnterpriseT1486Data Encrypted for Impact

Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.[1]

EnterpriseT1110.001Password GuessingSub-technique

Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.[1][2]

EnterpriseT1218.010Regsvr32Sub-technique

Xbash can use regsvr32 for executing scripts.[1]

EnterpriseT1016System Network Configuration Discovery

Xbash can collect IP addresses and local intranet information from a victim’s machine.[1]

EnterpriseT1102.001Dead Drop ResolverSub-technique

Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1485: Data DestructionEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1218.005: MshtaEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1053.003: CronEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1110.001: Password GuessingEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1102.001: Dead Drop ResolverEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
ad8948d71cab7aea...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundlead8948d71cab…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  2. [2]
    Trend Micro Xbash Sept 2018

    Trend Micro. (2018, September 19). New Multi-Platform Xbash Packs Obfuscation, Ransomware, Coinminer, Worm and Botnet. Retrieved June 4, 2019.

    Open source URL
  3. [3]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  4. [4]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  5. [5]
    Xbash

    (Citation: Unit42 Xbash Sept 2018)

  6. [6]
    Xbash

    (Citation: Unit42 Xbash Sept 2018)

  7. [7]
    Xbash

    (Citation: Unit42 Xbash Sept 2018)

  8. [8]
    mitre-attackS0341
    Open source URL
  9. [9]
    mitre-attackS0341
    Open source URL
  10. [10]
    mitre-attackS0341
    Open source URL
  11. [11]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  12. [12]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  13. [13]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  14. [14]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  15. [15]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  16. [16]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  17. [17]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  18. [18]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  19. [19]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  20. [20]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  21. [21]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  22. [22]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  23. [23]
    Trend Micro Xbash Sept 2018

    Trend Micro. (2018, September 19). New Multi-Platform Xbash Packs Obfuscation, Ransomware, Coinminer, Worm and Botnet. Retrieved June 4, 2019.

    Open source URL
  24. [24]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  25. [25]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  26. [26]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  27. [27]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  28. [28]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  29. [29]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  30. [30]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  31. [31]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  32. [32]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  33. [33]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  34. [34]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  35. [35]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  36. [36]
    Trend Micro Xbash Sept 2018

    Trend Micro. (2018, September 19). New Multi-Platform Xbash Packs Obfuscation, Ransomware, Coinminer, Worm and Botnet. Retrieved June 4, 2019.

    Open source URL
  37. [37]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  38. [38]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  39. [39]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
  40. [40]
    Unit42 Xbash Sept 2018

    Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use