Ebury — Malware Profile
Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.
MITRE ATT&CK techniques (21)
- T1008 Fallback Channels
- T1014 Rootkit
- T1020 Automated Exfiltration
- T1027 Obfuscated Files or Information
- T1041 Exfiltration Over C2 Channel
- T1059.004 Unix Shell
- T1059.006 Python
- T1071.004 DNS
- T1129 Shared Modules
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1552.004 Private Keys
- T1553.002 Code Signing
- T1554 Compromise Host Software Binary
- T1556 Modify Authentication Process
- T1556.003 Pluggable Authentication Modules
- T1568.002 Domain Generation Algorithms
- T1573.001 Symmetric Cryptography
- T1574.006 Dynamic Linker Hijacking
- T1685 Disable or Modify Tools
- T1685.004 Disable or Modify Linux Audit System Log