Home / Threat actors / Windigo
Windigo G0124
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
7
Techniques
1
Malware and tools
The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Initial Access
T1189 Drive-by Compromise Execution
T1059 Command and Scripting Interpreter Discovery
T1082 System Information DiscoveryT1083 File and Directory DiscoveryT1518 Software Discovery Collection
T1005 Data from Local System Command and Control
T1090 Proxy Malware and tools
- EburyMalwareS0377
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.