The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.[1][2]
7
TechniquesBottom 24%
5
Tactics26th pct
1
Tool or malwareBottom 23%
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.7
Windigo has distributed Windows malware via drive-by downloads.8
Initial Access6 detection rules
Standing G0124
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques7Bottom 24%
24th percentile · 76% of 176 ATT&CK groups have more Enterprise techniques.
Tactics526th pct
26th percentile · 74% of 176 ATT&CK groups have more tactics spanned.
Tool or malware1Bottom 23%
23rd percentile · 77% of 176 ATT&CK groups have more tools and malware.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique29med74th pct
74th percentile · 74% of 176 ATT&CK groups have this many detection rules per technique or fewer.
Tests / technique3med50th pct
50th percentile · 50% of 176 ATT&CK groups have more atomic tests per technique.
Data comps / technique4med65% tie · 12 values
65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique1med43% tie · 11 values
43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 7 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)
This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)
This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. (...)
The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. (...)
This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...)
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. (...)
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. (...)