S0377: Ebury

Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.[1][2][3][4]

EnterpriseS0377MalwareObject v2.0ModifiedSep 20, 2024, 21:15 UTC (UTC+00:00)

S0377: Ebury describes [Ebury](https://attack.mitre.org/software/S0377) is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by [Windigo](https://attack.mitre.org/groups/G0124). [Ebury](https://attack.mitre.org/software/S0377) is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, [Ebury](https://attack.mitre.org/software/S0377) has been used to maintain a botnet of servers, deploy additional malware, and steal ...

Executive priority

S0377: Ebury is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0377: Ebury by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0377: Ebury appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Ebury

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques21 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1014	Rootkit	Ebury acts as a user land rootkit using the SSH service.[3][4]
Enterprise	T1059.004	Unix ShellSub-technique	Ebury can use the commands `Xcsh` or `Xcls` to open a shell with Ebury level permissions and `Xxsh` to open a shell with root level.[4]
Enterprise	T1556.003	Pluggable Authentication ModulesSub-technique	Ebury can deactivate PAM modules to tamper with the sshd configuration.[3]
Enterprise	T1071.004	DNSSub-technique	Ebury has used DNS requests over UDP port 53 for C2.[1]
Enterprise	T1008	Fallback Channels	Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.[3]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.[3]
Enterprise	T1556	Modify Authentication Process	Ebury can intercept private keys using a trojanized `ssh-add` function.[1]
Enterprise	T1020	Automated Exfiltration	If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.CitationESET Windigo Mar 2014[4]
Enterprise	T1573.001	Symmetric CryptographySub-technique	Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.[1]
Enterprise	T1685.004	Disable or Modify Linux Audit System LogSub-technique	Ebury disables OpenSSH, system (`systemd`), and audit logs (`/sbin/auditd`) when the backdoor is active.[4]
Enterprise	T1554	Compromise Host Software Binary	Ebury modifies the `keyutils` library to add malicious behavior to the OpenSSH client and the curl library.[1][4]
Enterprise	T1027	Obfuscated Files or Information	Ebury has obfuscated its strings with a simple XOR encryption with a static key.[1]
Enterprise	T1685	Disable or Modify Tools	Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.[3]
Enterprise	T1132.001	Standard EncodingSub-technique	Ebury has encoded C2 traffic in hexadecimal format.[1]
Enterprise	T1059.006	PythonSub-technique	Ebury has used Python to implement its DGA.[3]
Enterprise	T1574.006	Dynamic Linker HijackingSub-technique	When Ebury is running as an OpenSSH server, it uses LD_PRELOAD to inject its malicious shared module in to programs launched by SSH sessions. Ebury hooks the following functions from `libc` to inject into subprocesses; `system`, `popen`, `execve`, `execvpe`, `execv`, `execvp`, and `execl`.[3][4]
Enterprise	T1129	Shared Modules	Ebury is executed through hooking the keyutils.so file used by legitimate versions of `OpenSSH` and `libcurl`.[4]
Enterprise	T1553.002	Code SigningSub-technique	Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.[1]
Enterprise	T1552.004	Private KeysSub-technique	Ebury has intercepted unencrypted private keys as well as private key pass-phrases.[1]
Enterprise	T1041	Exfiltration Over C2 Channel	Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's `known_host` files and `wtmp` records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command `Xcat` to send the process's ssh session's credentials to the C2 server.CitationESET Windigo Mar 2014[4]
Enterprise	T1568.002	Domain Generation AlgorithmsSub-technique	Ebury has used a DGA to generate a domain name for C2.[1][3]

Associated objects

Groups, software, and campaigns

G0124: Windigo

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.[1][2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 2.0
Created: Apr 19, 2019, 16:40 UTC (UTC+00:00)
Modified: Sep 20, 2024, 21:15 UTC (UTC+00:00)
Raw hash: f6d32b7781e406e5...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.0	Sep 20, 2024, 21:15 UTC (UTC+00:00)	Current bundle	`f6d32b7781e4…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.0	Sep 20, 2024, 21:15 UTC (UTC+00:00)	Older bundle	`f6d32b7781e4…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
ESET Ebury Feb 2014
M.Léveillé, M.. (2014, February 21). An In-depth Analysis of Linux/Ebury. Retrieved April 19, 2019.
Open source URL
[2]
BleepingComputer Ebury March 2017
Cimpanu, C.. (2017, March 29). Russian Hacker Pleads Guilty for Role in Infamous Linux Ebury Malware. Retrieved April 23, 2019.
Open source URL
[3]
ESET Ebury Oct 2017
Vachon, F. (2017, October 30). Windigo Still not Windigone: An Ebury Update . Retrieved February 10, 2021.
Open source URL
[4]
ESET Ebury May 2024
Marc-Etienne M.Léveillé. (2024, May 1). Ebury is alive but unseen. Retrieved May 21, 2024.
Open source URL
[5]
Ebury
(Citation: ESET Ebury Feb 2014)
[6]
mitre-attackS0377
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use