Malware: Winnti for Linux

Description

[Winnti for Linux](https://attack.mitre.org/software/S0430) is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including [Winnti Group](https://attack.mitre.org/groups/G0044). The Windows variant is tracked separately under [Winnti for Windows](https://attack.mitre.org/software/S0141).(Citation: Chronicle Winnti for Linux May 2019)

External References

• mitre-attack
• Chronicle Winnti for Linux May 2019

Techniques Used by This Malware

• T1014 — Rootkit
• T1027.013 — Encrypted/Encoded File
• T1071.001 — Web Protocols
• T1095 — Non-Application Layer Protocol
• T1105 — Ingress Tool Transfer
• T1140 — Deobfuscate/Decode Files or Information
• T1205 — Traffic Signaling
• T1573.001 — Symmetric Cryptography

APT Groups Using This Malware

• Aquatic Panda
• Earth Lusca
• APT41