Linux threat wiki
The malware that attacks Linux servers: what each one is, the signs it leaves, and how to remove it by hand, or when the honest answer is to back up and rebuild. Every page says whether we have tested its removal ourselves.
18 full pages so far. See all 118 documented Linux threats, including the ones we haven't written up yet.
- MiraiMirai is a family of botnet programs.
- DreamBusDreamBus is a botnet built from shell scripts and Linux programs that mines the cryptocurrency Monero with the XMRig miner.
- MuhstikMuhstik is a botnet controlled through a chat channel (IRC), descended from the older Tsunami bot.
- PrometeiPrometei is a botnet made of several parts that mines the cryptocurrency Monero and steals passwords, with versions for both Linux and Windows.
- RedTailRedTail is a cryptocurrency miner for Linux that mines Monero.
- SysrvSysrv, also seen as Sysrv-hello, is a botnet written in the Go language that takes over Linux and Windows servers to mine the cryptocurrency Monero, using a built-in…
- TsunamiTsunami, also called Kaiten, is an old, openly published bot program.
- BPFDoorBPFDoor is a hidden backdoor for Linux servers and appliances that stay running for long stretches, notably in telephone and mobile networks.
- ChaosChaos is a botnet program written in Go, a successor to an older botnet called Kaiji.
- HeadCrabHeadCrab goes after Redis database servers left open to the internet, on virtual machines and in containers.
- KinsingKinsing takes over Linux servers and container hosts to mine cryptocurrency, using your server's processor and electricity for the attacker's profit.
- P2PInfectP2PInfect is a botnet program written in Rust that takes over Redis servers.
- perfctlperfctl takes over Linux servers to mine cryptocurrency with XMRig, a mining program, using your server's processor for the attacker's profit.
- PumaBotPumaBot is a botnet program written in Go that takes over internet-connected Linux devices, notably traffic cameras and surveillance systems.
- PwnRigPwnRig is a cryptocurrency miner, a modified build of the XMRig mining program, used by the group researchers call the 8220 Gang.
- ReptileReptile is a rootkit, a tool that hides an attacker's presence, published openly as source code and used against Linux servers and virtual machines.
- SkidmapSkidmap takes over Linux servers to mine cryptocurrency, using your server's processor for the attacker's profit.
- XorDDoSXorDDoS takes over Linux servers and devices and uses them to flood websites and networks with traffic on command (a DDoS attack).
No threat matches that. Try a shorter word, or clear a filter. The full list has every documented Linux threat.
These steps are provided as-is, without warranty. Run them at your own risk, and back up first. If you're unsure, rebuild from a known-good install.