ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0377malware

Ebury

Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (.so files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.

Platforms: Linux

MITRE ATT&CK ↗

Linked entities · 22

usesT1014Rootkit usesT1059.004Unix Shell usesT1556.003Pluggable Authentication Modules usesT1071.004DNS usesT1008Fallback Channels usesT1140Deobfuscate/Decode Files or Infor…usesT1556Modify Authentication Process usesT1020Automated Exfiltration usesT1573.001Symmetric Cryptography usesT1685.004Disable or Modify Linux Audit Sys…usesT1554Compromise Host Software Binary usesT1027Obfuscated Files or Information usesT1685Disable or Modify Tools usesT1132.001Standard Encoding usesT1059.006Python usesT1574.006Dynamic Linker Hijacking usesT1129Shared Modules usesT1553.002Code Signing usesT1552.004Private Keys usesT1041Exfiltration Over C2 Channel usesT1568.002Domain Generation Algorithms uses byG0124Windigo