Most detection programmes were built for Windows endpoints, yet the servers, container hosts and hypervisors that run production workloads are Linux or ESXi, and malware built for them is designed to look like normal system daemons. MITRE ATT&CK Enterprise v20 catalogues 25 software entries that NHI Mgmt Group groups as Linux, cloud and ESXi malware: OpenSSH backdoors, passive packet-filter implants, kernel rootkits, container cryptominers and hypervisor backdoors. This hub lists every one of them with platforms, associated groups and distinctive techniques, shows which behaviours they share, and turns those into detection and hardening themes for Linux fleets, Kubernetes and vSphere. It is for Linux and platform engineers, cloud security teams and detection engineers. Linux malware on network appliances is covered in the network device hub.
Key takeaways
- Linux is the common base. 24 of the 25 entries list Linux in ATT&CK v20; three also list Containers, two list ESXi and one (Hildegard) lists IaaS.
- Unix shell and tool transfer are near universal. 15 entries map to T1059.004 Unix Shell and 14 to T1105 Ingress Tool Transfer, so shell and download activity by service accounts is the broadest detection surface.
- OpenSSH is a favoured hiding place. Ebury, Bonadan, Kessel and Kobalos map to T1554 Compromise Host Software Binary, and Ebury and Kessel steal credentials as they pass through the SSH daemon.
- Persistence looks like administration. Six entries create systemd services and five use cron, the same mechanisms legitimate packages use, so baselining matters more than signatures.
- Cloud and container malware hunts credentials. Hildegard and Kinsing search for keys and tokens, and in hypervisor intrusions an ESXi backdoor gives control over every guest, so these are identity incidents as much as malware incidents.
What sits in this category
The sub-groups below are an NHI Mgmt Group reading of the ATT&CK v20 descriptions and platforms; MITRE does not group software this way.
| Sub-group | Members | Typical target |
|---|---|---|
| OpenSSH backdoors and credential stealers | Ebury, Bonadan, Kessel, Kobalos | Internet-facing Linux servers and hosting estates |
| Espionage backdoors and implants | Exaramel for Linux, Fysbis, Winnti for Linux, Drovorub, Penquin, RotaJakiro, BPFDoor, Gomir, MOPSLED, RIFLESPINE, DEEPROOT, HiddenWasp, MESSAGETAP | Government, telecom and technology servers |
| Hypervisor backdoors | VIRTUALPITA, VIRTUALPIE | VMware ESXi hosts and Linux vCenter |
| Container and cloud cryptojacking | Kinsing, Doki, Hildegard | Docker APIs, kubelets and cloud instances |
| Commodity Linux and IoT malware | Chaos, Linux Rabbit, SpeakUp | Servers and IoT devices with weak SSH or unpatched services |
BRICKSTORM, which runs on Linux, ESXi and network devices, is catalogued in the ATT&CK Network Device Malware Software Hub. Server web shells are in the ATT&CK Web Shells Software Hub.
Shared behaviours across the 25 entries
Counts are computed from the current "uses" relationships between these entries and techniques in ATT&CK Enterprise v20 (revoked and deprecated objects excluded).
| Technique | Entries using it | Defender meaning |
|---|---|---|
| T1059.004 Unix Shell | 15 | Shells spawned by daemons, web servers or service accounts that normally never run one |
| T1105 Ingress Tool Transfer | 14 | curl, wget or custom downloaders writing executables to /tmp, /dev/shm or /var/tmp. See T1105 Ingress Tool Transfer Defensive Guide. |
| T1140 Deobfuscate/Decode Files or Information | 12 | Encrypted or packed payloads unpacked at run time |
| T1082 System Information Discovery | 11 | uname, /proc and hostname checks on first run |
| T1070.004 File Deletion | 10 | Installers and scripts deleting themselves; auditd catches the unlink even when the file is gone |
| T1573.001, T1071.001 and T1027.013 | 9 each | Encrypted C2 over web protocols with encrypted files on disk |
| T1543.002 Systemd Service | 6 | New unit files, often named after real services. See T1543 Create or Modify System Process Defensive Guide. |
| T1053.003 Cron | 5 | New crontab entries for persistence or re-infection. See T1053 Scheduled Task/Job Defensive Guide. |
| T1014 Rootkit | 5 | Ebury, HiddenWasp, Winnti for Linux, Drovorub and Hildegard hide files or processes. See MITRE ATT&CK T1014 Rootkit. |
| T1205 Traffic Signaling | 5 | Chaos, Winnti for Linux, Penquin, Kobalos and BPFDoor wait for a crafted packet rather than beaconing. See MITRE ATT&CK T1205 Traffic Signaling. |
| T1554 Compromise Host Software Binary | 4 | Trojanised OpenSSH binaries (Ebury, Bonadan, Kessel, Kobalos) |
| T1574.006 Dynamic Linker Hijacking | 3 | /etc/ld.so.preload or LD_PRELOAD used to hide or hook (Ebury, HiddenWasp, Hildegard) |
Cloud-specific behaviours are fewer but high impact: Kinsing, Doki, Hildegard and Linux Rabbit use T1133 External Remote Services, Kinsing and Doki use T1610 Deploy Container, Doki and Hildegard use T1611 Escape to Host, and Bonadan, Kinsing and Hildegard use T1496 Resource Hijacking.
Complete catalogue: all 25 Linux, cloud and ESXi entries in ATT&CK v20
Every entry assigned to this hub, in ATT&CK ID order. "Associated groups and campaigns" shows up to three current group relationships in v20, linking a live NHI Mgmt Group actor profile where one exists. "Techniques" is the count of current technique relationships, and "Distinctive techniques" lists each entry's least common techniques within this category.
| ID | Name | Type | Platforms | Associated groups and campaigns | Techniques | Distinctive techniques |
|---|---|---|---|---|---|---|
| S0220 | Chaos | Malware | Linux | No group relationship in v20 | 5 | T1104 Multi-Stage Channels; T1110 Brute Force; T1205 Traffic Signaling |
| S0362 | Linux Rabbit | Malware | Linux | No group relationship in v20 | 6 | T1110.003 Password Spraying; T1132 Data Encoding; T1078 Valid Accounts |
| S0374 | SpeakUp | Malware | Linux, macOS | No group relationship in v20 | 15 | T1110.001 Password Guessing; T1203 Exploitation for Client Execution; T1046 Network Service Discovery |
| S0377 | Ebury | Malware | Linux | Windigo (G0124) | 21 | T1071.004 DNS; T1553.002 Code Signing; T1556.003 Pluggable Authentication Modules |
| S0394 | HiddenWasp | Malware | Linux | No group relationship in v20 | 10 | T1037.004 RC Scripts; T1059.003 Windows Command Shell; T1136.001 Local Account |
| S0401 | Exaramel for Linux | Malware | Linux | Sandworm Team (G0034) | 12 | T1543 Create or Modify System Process; T1548.001 Setuid and Setgid; T1008 Fallback Channels |
| S0410 | Fysbis | Malware | Linux | APT28 (G0007) | 12 | T1056.001 Keylogging; T1547.013 XDG Autostart Entries; T1036.004 Masquerade Task or Service |
| S0430 | Winnti for Linux | Malware | Linux | APT41 (G0096), Aquatic Panda (G0143), Earth Lusca (G1006) | 8 | T1205 Traffic Signaling; T1014 Rootkit; T1095 Non-Application Layer Protocol |
| S0443 | MESSAGETAP | Malware | Linux | APT41 (G0096) | 8 | T1560.003 Archive via Custom Method; T1040 Network Sniffing; T1049 System Network Connections Discovery |
| S0486 | Bonadan | Malware | Linux | No group relationship in v20 | 9 | T1059 Command and Scripting Interpreter; T1496.001 Compute Hijacking; T1554 Compromise Host Software Binary |
| S0487 | Kessel | Malware | Linux | No group relationship in v20 | 14 | T1030 Data Transfer Size Limits; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1090 Proxy |
| S0502 | Drovorub | Malware | Linux | APT28 (G0007) | 12 | T1005 Data from Local System; T1547.006 Kernel Modules and Extensions; T1090.001 Internal Proxy |
| S0587 | Penquin | Malware | Linux | Turla (G0010) | 18 | T1027.005 Indicator Removal from Tools; T1680 Local Storage Discovery; T1040 Network Sniffing |
| S0599 | Kinsing | Malware | Containers, Linux | No group relationship in v20 | 17 | T1021.004 SSH; T1552.003 Shell History; T1018 Remote System Discovery |
| S0600 | Doki | Malware | Linux, Containers | No group relationship in v20 | 14 | T1020 Automated Exfiltration; T1568.002 Domain Generation Algorithms; T1610 Deploy Container |
| S0601 | Hildegard | Malware | Linux, Containers, IaaS | TeamTNT (G0139) | 27 | T1027.002 Software Packing; T1068 Exploitation for Privilege Escalation; T1071 Application Layer Protocol |
| S0641 | Kobalos | Malware | Linux | No group relationship in v20 | 15 | T1048 Exfiltration Over Alternative Protocol; T1056 Input Capture; T1074 Data Staged |
| S1078 | RotaJakiro | Malware | Linux | APT32 (G0050) | 17 | T1106 Native API; T1559 Inter-Process Communication; T1037 Boot or Logon Initialization Scripts |
| S1161 | BPFDoor | Malware | Linux | No group relationship in v20 | 13 | T1036.009 Break Process Trees; T1036.011 Overwrite Process Arguments; T1070 Indicator Removal |
| S1198 | Gomir | Malware | Linux | Kimsuky (G0094) | 14 | T1069.001 Local Groups; T1573 Encrypted Channel; T1018 Remote System Discovery |
| S1217 | VIRTUALPITA | Malware | ESXi, Linux | UNC3886 (G1048) | 12 | T1489 Service Stop; T1673 Virtual Machine Discovery; T1675 ESXi Administration Command |
| S1218 | VIRTUALPIE | Malware | ESXi | UNC3886 (G1048) | 6 | T1059.012 Hypervisor CLI; T1505.006 vSphere Installation Bundles; T1570 Lateral Tool Transfer |
| S1221 | MOPSLED | Malware | Linux | APT41 (G0096), UNC3886 (G1048) | 6 | T1102.001 Dead Drop Resolver; T1102 Web Service; T1095 Non-Application Layer Protocol |
| S1222 | RIFLESPINE | Malware | Linux | UNC3886 (G1048) | 10 | T1102.002 Bidirectional Communication; T1567.002 Exfiltration to Cloud Storage; T1074.001 Local Data Staging |
| S9063 | DEEPROOT | Malware | Linux | NIMBUS MANTICORE (G1059) | 10 | T1678 Delay Execution; T1008 Fallback Channels; T1033 System Owner/User Discovery |
Ten entries have no group relationship in v20. Descriptions still help with some of them: BPFDoor, for example, is described as used by China-based threat actors. UNC3886 has the most entries here (VIRTUALPITA, VIRTUALPIE, MOPSLED and RIFLESPINE); see the UNC3886 Threat Actor Profile Guide.
Real cases that shaped the category
Malicious VIBs on ESXi: UNC3886, 2022
Mandiant reported in September 2022 that an actor it tracks as UNC3886 installed malicious vSphere Installation Bundles to persist on ESXi hosts, deploying VIRTUALPITA, a passive ELF backdoor that used VMware service names to blend in and could stop and start vmsyslogd, and VIRTUALPIE, a Python backdoor listening on IPv6 port 546. The actor needed administrative access to the hypervisor, edited the VIB descriptor's acceptance level from community to partner, and installed with the force flag. Mandiant found that esxcli software vib list could be misled by the edited descriptor and that esxcli software vib signature verify exposed the falsified bundles. Mandiant assessed a China nexus with low confidence. See the VMware ESXi Hardening Guide and ESXi Logs Detection Guide.
Ebury: a 15-year OpenSSH campaign
ESET reported in May 2024 that Ebury had compromised about 400,000 Linux servers since 2009, with more than 100,000 still compromised at the end of 2023. Operators installed it across hosting providers' estates and used it to steal credentials and cryptocurrency wallets as users authenticated; version 1.8 added a userland rootkit hiding processes, files, sockets and mapped memory.
Hildegard and TeamTNT: Kubernetes and Docker
Unit 42 reported in February 2021 that Hildegard entered Kubernetes clusters through kubelets that allowed anonymous access, used tmate and IRC for C2, hid processes with /etc/ld.so.preload, mined Monero, and searched for cloud access keys, Kubernetes service account tokens and SSH keys, including from the metadata endpoints 169.254.169.254 and 169.254.170.2. Unit 42 attributed it to TeamTNT. An earlier TeamTNT worm read AWS credential files from Docker hosts, as described on the TeamTNT worm 2020 breach page.
Detection themes for Linux, containers and ESXi
| Signal | Telemetry | What to alert on | Families it would surface |
|---|---|---|---|
| Package integrity of sshd and core binaries | rpm -V or debsums results; file integrity monitoring | Any change to /usr/sbin/sshd, ssh client binaries or shared libraries outside a package update | Ebury, Bonadan, Kessel, Kobalos |
| Preload and linker changes | auditd watch on /etc/ld.so.preload; FIM | Creation or edit of /etc/ld.so.preload, LD_PRELOAD in service environments | Ebury, HiddenWasp, Hildegard |
| New persistence | auditd watches on /etc/systemd/system, /etc/cron*, /var/spool/cron | New unit or crontab not created by configuration management | Exaramel, Fysbis, RotaJakiro, Gomir, Kinsing |
| Raw socket and packet filter use | EDR or eBPF sensor; ss -0 or lsof checks for packet sockets | Unexpected processes holding raw or packet sockets | BPFDoor and other passive backdoors |
| Container and kubelet abuse | Kubernetes audit logs; kubelet logs; runtime security sensor | Anonymous kubelet requests, exec into pods by unknown identities, privileged containers, miners | Hildegard, Kinsing, Doki |
| Hypervisor changes | ESXi syslog forwarded off-host; vib signature verify output | VIB installs with force or community acceptance, unexpected listening ports, vmsyslogd stopped | VIRTUALPITA, VIRTUALPIE |
| Metadata and credential file access | Cloud audit logs; host process telemetry | Non-agent processes calling the instance metadata service or reading ~/.aws, ~/.kube or ~/.docker | Hildegard, TeamTNT tooling |
Because rootkits in this hub hide from /proc-based tools on the host, compare host views with an external view (network flows, hypervisor or cloud provider telemetry) when compromise is suspected. For collection and analysis see the Linux Detection and Response Guide, the Linux Logging and auditd for Defenders Guide and the Linux Forensics Guide.
Hardening priorities
- Remove password SSH logins on exposed hosts: Chaos, Linux Rabbit, SpeakUp and Kinsing use brute force, so key or certificate authentication with rate limiting removes a whole entry path. See the OpenSSH Server Hardening Guide.
- Close management APIs: no anonymous kubelet access, no unauthenticated Docker API, and management interfaces only from administrative networks.
- Enforce ESXi bundle trust: keep the acceptance level at PartnerSupported or higher, alert on forced VIB installs, and restrict ESXi administration to a small set of accounts.
- Allowlist execution: mount /tmp and /dev/shm noexec where workloads allow, and use application allowlisting on servers with stable software. See the fapolicyd and Linux Application Allowlisting Guide.
- Replace static cloud keys on hosts: use instance roles and workload identity so a compromised host does not hold long-lived keys, and require IMDSv2 or equivalent. See the Cloud Instance Metadata Services Compared Guide.
- Rebuild rather than clean: a host with a confirmed rootkit or trojanised sshd is reimaged from a known-good build, not disinfected in place.
Roll out new auditd and runtime rules in monitoring mode on a pilot group first, measure event volume, then promote to alerting; keep noexec and allowlisting changes reversible through configuration management.
Where identity fits
Every case in this hub ends with stolen machine credentials: SSH passwords and keys captured by trojanised sshd, cloud access keys and Kubernetes service account tokens collected by Hildegard, and hypervisor administrator access that controls every guest. After any confirmed infection, rotate SSH keys and host keys, cloud keys, service account tokens and any secrets in files the host could read, and review where the stolen credentials were used. See the SSH Key Compromise Response Playbook and How to Find ssh authorized keys across a server fleet.
Detection and measurement
- Sensor coverage: share of Linux servers, Kubernetes nodes and ESXi hosts sending process, audit or syslog telemetry to the SIEM (target 100%).
- Binary integrity: hosts with unexplained package verification failures on sshd and core libraries (target zero).
- Exposure: count of internet-reachable SSH services with password authentication, anonymous kubelets and unauthenticated Docker APIs.
- Static keys on hosts: long-lived cloud access keys found on servers and build hosts, trending to zero.
- ESXi bundle trust: hosts below PartnerSupported acceptance level or with unsigned VIBs.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1554, T1574.006, T1014, T1205, T1611, T1552 | Binary tampering, linker hijacking, rootkits, passive backdoors, container escape, credential theft |
| NIST SP 800-53 Rev. 5 | SI-7 Software, Firmware, and Information Integrity; CM-7 Least Functionality; IA-5 Authenticator Management; SI-4 System Monitoring | Integrity, reduced attack surface, credential rotation, monitoring |
| NIST CSF 2.0 | PR.PS-02; DE.CM-09 | Software maintenance and runtime monitoring |
| CIS Controls v8.1 | Control 2 Inventory and Control of Software Assets; Control 4 Secure Configuration of Enterprise Assets and Software; Control 8 Audit Log Management | Allowlisting, hardening and logging on servers and hypervisors |
Practitioner checklist
- Verify sshd and core library packages fleet-wide and alert on unexplained changes.
- Watch /etc/ld.so.preload, systemd unit directories and crontabs with auditd or FIM.
- Disable password SSH authentication on exposed hosts.
- Close anonymous kubelet access and unauthenticated Docker APIs.
- Forward ESXi logs off-host and run vib signature verification on a schedule.
- Remove static cloud keys from servers and build hosts in favour of short-lived workload credentials.
- Look for processes holding raw or packet sockets on servers that do not need them.
- Reimage, do not clean, hosts with confirmed rootkits or trojanised binaries, and rotate every credential they held.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: T1554 Compromise Host Software Binary
- Mandiant: Bad VIB(E)s Part One, investigating novel malware persistence within ESXi hypervisors
- ESET Research: Ebury is alive but unseen
- Palo Alto Networks Unit 42: Hildegard, new TeamTNT cryptojacking malware targeting Kubernetes
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- CIS: Critical Security Controls v8.1
Related NHI Mgmt Group resources: Linux Detection and Response Guide · VMware ESXi Hardening Guide · Kubernetes Security Guide · ATT&CK Network Device Malware Software Hub · Cryptojacking Guide