Ebury
Software · ATTACK:enterprise:S0377
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0377",
"title": "Ebury",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0377",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--d6b3fcd0-1c86-4350-96f0-965ed02fcc51",
"external_id": "S0377",
"domain": "enterprise",
"created": "2019-04-19T16:40:24.922Z",
"modified": "2024-09-20T21:15:51.302Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Ebury"
},
{
"source_name": "BleepingComputer Ebury March 2017",
"url": "https://www.bleepingcomputer.com/news/security/russian-hacker-pleads-guilty-for-role-in-infamous-linux-ebury-malware/"
},
{
"source_name": "ESET Ebury Feb 2014",
"url": "https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/"
},
{
"source_name": "ESET Ebury May 2024",
"url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf"
},
{
"source_name": "ESET Ebury Oct 2017",
"url": "https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05a3d203-4b38-4f38-a015-dcfe3bdf9c07
ESET Ebury May 2024 · ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0929a479-8ece-4c24-a97f-4da7e33d3c2f
ESET Ebury May 2024ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1556.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b7d2693-022f-41be-a8b7-0f433e3ec48d
ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b27a43c-3508-4f21-9f39-c05b2be84cb6
ESET Ebury Feb 2014ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36849ab3-088c-47a5-bcf9-3e68902a2e60
ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4800e509-0653-4895-a9f0-e0b538592875
ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1556
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b5a618e-3a67-4223-a158-af4ce7e0c7d9
ESET Ebury Feb 2014ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:S0377
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66a73f1e-dfb8-4509-be62-787c9a14c221
ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ff6558d-3efb-4219-8d47-ecf82755ccf1
ESET Windigo Mar 2014 · ESET Ebury May 2024ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77bcb339-4a2f-4fa6-9145-c653000952dc
ESET Ebury Feb 2014ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1685.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cf74519-c7ce-4a62-be77-89da43a6ff37
ESET Ebury May 2024ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d90820b-fd91-4452-aa91-50b783c2da38
ESET Ebury Feb 2014 · ESET Ebury May 2024ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9af6241d-355a-4673-b772-8384a718ed64
ESET Ebury Feb 2014ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be278ea8-19b6-4d42-ac7f-9ee8681a17e3
ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c128b821-b39b-481a-91a1-a2bad7d6dda2
ESET Ebury Feb 2014ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1806927-2279-4597-ada9-e0c06b65b7eb
ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3102278-dab8-485c-9cd2-52f80c4da8bd
ESET Ebury May 2024 · ESET Ebury Oct 2017ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da8e4a55-195f-4fbc-8a8b-565581d3a3d4
ESET Ebury May 2024ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dddaffe1-4d47-4ffd-93e4-3827dc9abb50
ESET Ebury Feb 2014ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1552.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2772353-e6f8-406e-8416-fa4edeecd218
ESET Ebury Feb 2014ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6ce13c0-7a23-4974-bacc-187eedd9c6da
ESET Windigo Mar 2014 · ESET Ebury May 2024ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1568.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc0433bf-560f-4b5f-879c-f87581d7f504
ESET Ebury Feb 2014 · ESET Ebury Oct 2017