Threat wiki
Linux threats: how to spot them and remove them
A free guide to the malware that attacks Linux servers: what each one is, the signs it leaves, and how to remove it by hand, or when the honest answer is to back up and rebuild. Every page says whether we have tested its removal ourselves. See every documented Linux threat.
MiraiIoT DDoS botnet client (Linux ELF, memory-resident)Tested by us on a real sampleDreamBusCryptomining botnet (XMRig, Monero) built from shell scripts and ELF modulesTested on a planted test copy, not a real sampleMuhstikIRC-controlled DDoS and cryptomining botnet (Tsunami/Kaiten lineage)Tested on a planted test copy, not a real samplePrometeiModular Monero-mining botnet with a Linux variant (backdoor, credential theft, self-updating)Tested on a planted test copy, not a real sampleRedTailLinux cryptominer (Monero) delivered as per-architecture binariesTested on a planted test copy, not a real sampleSysrvGo cryptominer botnet (XMRig-based Monero mining) with Linux and Windows buildsTested on a planted test copy, not a real sampleTsunamiIRC-controlled DDoS bot (Kaiten source lineage), Linux ELFDocumented from public research, not yet tested by usBPFDoorPassive Linux backdoor using a kernel packet filter, with spoofed process namesBack up and rebuildChaosGo multi-platform DDoS and proxy botnet (Kaiji successor)Back up and rebuildHeadCrabRedis-module cryptominer and backdoor with fileless (memory-only) payloads and kernel-module loadingBack up and rebuildKinsingCryptominer loader with an ld.so.preload userland rootkitBack up and rebuildP2PInfectRust peer-to-peer botnet with cryptominer and ransomware payloads and a usermode LD_PRELOAD rootkitBack up and rebuildperfctlStealthy Linux cryptominer (XMRig) with an LD_PRELOAD rootkit and trojanized system utilitiesBack up and rebuildPumaBotGo-based Linux IoT botnet with a cryptominer component and a PAM credential-stealing moduleBack up and rebuildPwnRigCryptominer (modified XMRig build) deployed with a loader script and an IRC botBack up and rebuildReptileOpen-source Linux kernel-module rootkit with a reverse-shell backdoorBack up and rebuildSkidmapCryptominer with loadable kernel module rootkits and a replaced PAM moduleBack up and rebuildXorDDoSDDoS botnet trojan with an optional loadable kernel module rootkitBack up and rebuild
These steps are provided as-is, without warranty. Run them at your own risk, and back up first. If you're unsure, rebuild from a known-good install.