Winnti for Linux

Malware & Tools · Winnti for Linux

· MalwareS0430 · Zararlı Yazılım

Type

malware

Techniques

Used By

3 groups

Platforms

Linux

Description

Winnti for Linux is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including Winnti Group. The Windows variant is tracked separately under Winnti for Windows.(Citation: Chronicle Winnti for Linux May 2019)

Tactic Coverage

command and control (5)stealth (4)persistence (1)

Used By (3 groups)

G0096APT41Wicked Panda, Brass Typhoon G0143Aquatic Panda G1006Earth LuscaTAG-22, Charcoal Typhoon

Techniques (8)

T1014Rootkit

stealth

T1027.013Encrypted/Encoded File

stealth

T1071.001Web Protocols

command and control

T1095Non-Application Layer Protocol

command and control

T1105Ingress Tool Transfer

command and control

T1140Deobfuscate/Decode Files or Information

stealth

T1205Traffic Signaling

References

https://attack.mitre.org/software/S0430 https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a