Threat wiki / Every documented threat
Every documented Linux threat
Every malware family known to attack Linux servers, ESXi hosts or containers that is documented in public research we can use: 112 so far. 18 have a full page here, 24 more are researched with a page on the way, and 70 are on our list to document. The list grows as our sensors catch new threats and as we research more.
| Threat | Also known as | Our page | Minaki Scan | Documented by |
|---|---|---|---|---|
| AcidPour | On our list to document | not yet | ATT&CK S1167 | |
| AcidRain | On our list to document | not yet | ATT&CK S1125 | |
| Anchor | Anchor_DNS | On our list to document | not yet | ATT&CK S0504 |
| AvosLocker | On our list to document | not yet | ATT&CK S1053 | |
| Babuk (Linux/ESXi locker) | Babyk, Babuk Locker, Babuk, Vasa Locker | Researched, page coming | not yet | our research (6 sources) · ATT&CK S0638 |
| BACKUPOSINT v9.0 APEX PREDATOR | On our list to document | not yet | ATT&CK S9045 | |
| BeaverTail | On our list to document | not yet | ATT&CK S1246 | |
| Black Basta | On our list to document | not yet | ATT&CK S1070 | |
| BlackCat (Linux/ESXi variant) | ALPHV, Noberus, BlackCat | Researched, page coming | not yet | our research (7 sources) · ATT&CK S1068 |
| BOLDMOVE | On our list to document | not yet | ATT&CK S1184 | |
| Bonadan | On our list to document | not yet | ATT&CK S0486 | |
| BPFDoor | JustForFun, Backdoor.Linux.BPFDOOR, Backdoor.Solaris.BPFDOOR.ZAJE | Full page | detects, advises rebuild | our research (4 sources) · ATT&CK S1161 |
| BRICKSTORM | On our list to document | not yet | ATT&CK S9015 | |
| BRUSHFIRE | On our list to document | not yet | ATT&CK S9011 | |
| CanisterWorm | On our list to document | not yet | ATT&CK S9042 | |
| Chaos | Full page | detects, advises rebuild | our research (3 sources) · ATT&CK S0220 | |
| Cheerscrypt | Researched, page coming | not yet | our research (5 sources) · ATT&CK S1096 | |
| CHOPSTICK | Backdoor.SofacyX, SPLM, Xagent, X-Agent | On our list to document | not yet | ATT&CK S0023 |
| COATHANGER | On our list to document | not yet | ATT&CK S1105 | |
| Cobalt Strike | On our list to document | not yet | ATT&CK S0154 | |
| CrossRAT | On our list to document | not yet | ATT&CK S0235 | |
| Dacls | Linux.Dacls | Researched, page coming | not yet | our research (3 sources) · ATT&CK S0497 |
| DEEPROOT | On our list to document | not yet | ATT&CK S9063 | |
| Derusbi | PHOTO | On our list to document | not yet | ATT&CK S0021 |
| Doki | Researched, page coming | not yet | our research (4 sources) · ATT&CK S0600 | |
| DreamBus | Full page | removes (after you type yes) | our research (3 sources) | |
| Drovorub | On our list to document | not yet | ATT&CK S0502 | |
| DRYHOOK | On our list to document | not yet | ATT&CK S9013 | |
| Ebury | Researched, page coming | not yet | our research (5 sources) · ATT&CK S0377 | |
| Embargo | On our list to document | not yet | ATT&CK S1247 | |
| Exaramel for Linux | On our list to document | not yet | ATT&CK S0401 | |
| FritzFrog | Researched, page coming | not yet | our research (5 sources) | |
| Fysbis | On our list to document | not yet | ATT&CK S0410 | |
| Gafgyt | Bashlite, Lizkebab | Researched, page coming | not yet | our research (3 sources) |
| GoldMax | SUNSHUTTLE | On our list to document | not yet | ATT&CK S0588 |
| Gomir | On our list to document | not yet | ATT&CK S1198 | |
| Green Lambert | On our list to document | not yet | ATT&CK S0690 | |
| Hadooken | Researched, page coming | not yet | our research (3 sources) | |
| Havoc | On our list to document | not yet | ATT&CK S1229 | |
| HeadCrab | Full page | detects, advises rebuild | our research (3 sources) | |
| HeartCrypt | On our list to document | not yet | ATT&CK S9018 | |
| HexEval Loader | On our list to document | not yet | ATT&CK S1249 | |
| HiddenWasp | Researched, page coming | not yet | our research (3 sources) · ATT&CK S0394 | |
| Hildegard | Researched, page coming | not yet | our research (3 sources) · ATT&CK S0601 | |
| InvisibleFerret | On our list to document | not yet | ATT&CK S1245 | |
| jRAT | JSocket, AlienSpy, Frutas, Sockrat | On our list to document | not yet | ATT&CK S0283 |
| Kessel | On our list to document | not yet | ATT&CK S0487 | |
| KEYPLUG | KEYPLUG.LINUX | On our list to document | not yet | ATT&CK S1051 |
| KillDisk | Win32/KillDisk.NBI, Win32/KillDisk.NBH, Win32/KillDisk.NBD, Win32/KillDisk.NBC | On our list to document | not yet | ATT&CK S0607 |
| Kinsing | NSPPS | Full page | detects, advises rebuild | our research (5 sources) · ATT&CK S0599 |
| Kobalos | Researched, page coming | not yet | our research (6 sources) · ATT&CK S0641 | |
| LightNeuron | On our list to document | not yet | ATT&CK S0395 | |
| Linux Rabbit | On our list to document | not yet | ATT&CK S0362 | |
| Manjusaka | On our list to document | not yet | ATT&CK S1156 | |
| MEDUSA | On our list to document | not yet | ATT&CK S1220 | |
| MESSAGETAP | On our list to document | not yet | ATT&CK S0443 | |
| Mini Shai-Hulud | On our list to document | not yet | ATT&CK S9043 | |
| Mirai | Full page | removes (after you type yes) | our research (6 sources) | |
| MOPSLED | On our list to document | not yet | ATT&CK S1221 | |
| Muhstik | Full page | removes (after you type yes) | our research (4 sources) | |
| Neo-reGeorg | On our list to document | not yet | ATT&CK S1189 | |
| NETWIRE | On our list to document | not yet | ATT&CK S0198 | |
| NKAbuse | Researched, page coming | not yet | our research (3 sources) · ATT&CK S1107 | |
| Outlaw | Dota | Researched, page coming | removes (after you type yes) | our research (5 sources) |
| P.A.S. Webshell | Fobushell | On our list to document | not yet | ATT&CK S0598 |
| P2PInfect | Full page | detects, advises rebuild | our research (3 sources) | |
| PACEMAKER | On our list to document | not yet | ATT&CK S1109 | |
| Penquin | Penquin 2.0, Penquin_x64 | On our list to document | not yet | ATT&CK S0587 |
| perfctl | Full page | detects, advises rebuild | our research (2 sources) | |
| PG_MEM | Researched, page coming | not yet | our research (3 sources) | |
| PHASEJAM | On our list to document | not yet | ATT&CK S9014 | |
| Prometei | Full page | removes (after you type yes) | our research (4 sources) | |
| PULSECHECK | On our list to document | not yet | ATT&CK S1108 | |
| PumaBot | Full page | detects, advises rebuild | our research (2 sources) | |
| PwnRig | Full page | detects, advises rebuild | our research (3 sources) | |
| Qilin | Agenda | On our list to document | not yet | ATT&CK S1242 |
| RansomHub | On our list to document | not yet | ATT&CK S1212 | |
| RAPIDPULSE | On our list to document | not yet | ATT&CK S1113 | |
| RedTail | Full page | removes (after you type yes) | our research (4 sources) | |
| reGeorg | On our list to document | not yet | ATT&CK S1187 | |
| Reptile | REPTILE | Full page | detects, advises rebuild | our research (3 sources) · ATT&CK S1219 |
| RIFLESPINE | On our list to document | not yet | ATT&CK S1222 | |
| RotaJakiro | Researched, page coming | not yet | our research (3 sources) · ATT&CK S1078 | |
| Royal | On our list to document | not yet | ATT&CK S1073 | |
| Royal (Linux/ESXi variant) | Researched, page coming | not yet | our research (6 sources) | |
| Shai-Hulud | On our list to document | not yet | ATT&CK S9008 | |
| ShellBot | PerlBot | Researched, page coming | not yet | our research (4 sources) |
| Siloscape | On our list to document | not yet | ATT&CK S0623 | |
| Skidmap | Full page | detects, advises rebuild | our research (3 sources) · ATT&CK S0468 | |
| SLIGHTPULSE | On our list to document | not yet | ATT&CK S1110 | |
| SnappyTCP | On our list to document | not yet | ATT&CK S1163 | |
| SPAWNCHIMERA | On our list to document | not yet | ATT&CK S9024 | |
| SpeakUp | Researched, page coming | not yet | our research (3 sources) · ATT&CK S0374 | |
| Sysrv | Sysrv-hello, Sysrv-New | Full page | removes (after you type yes) | our research (5 sources) |
| SystemBC (Linux variant) | Coroxy, DroxiDat, SystemBC | Researched, page coming | not yet | our research (4 sources) · ATT&CK S9001 |
| SysUpdate | HyperSSL, Soldier, FOCUSFJORD | On our list to document | not yet | ATT&CK S0663 |
| TeamPCP Cloud Stealer | SANDCLOCK | On our list to document | not yet | ATT&CK S9041 |
| The Gentlemen Ransomware | On our list to document | not yet | ATT&CK S9051 | |
| TRAILBLAZE | On our list to document | not yet | ATT&CK S9012 | |
| Tsunami | Kaiten | Full page | not yet | our research (4 sources) |
| Tsundere Botnet | DinDoor | On our list to document | not yet | ATT&CK S9034 |
| Turian | On our list to document | not yet | ATT&CK S0647 | |
| Umbreon | Researched, page coming | not yet | our research (4 sources) · ATT&CK S0221 | |
| Unauthorized XMRig | Researched, page coming | not yet | our research (4 sources) | |
| UPSTYLE | On our list to document | not yet | ATT&CK S1164 | |
| Uroburos | Snake | On our list to document | not yet | ATT&CK S0022 |
| VIRTUALPIE | On our list to document | not yet | ATT&CK S1218 | |
| VIRTUALPITA | On our list to document | not yet | ATT&CK S1217 | |
| VPNFilter | On our list to document | not yet | ATT&CK S1010 | |
| Winnti for Linux | Researched, page coming | not yet | our research (5 sources) · ATT&CK S0430 | |
| Xbash | Researched, page coming | not yet | our research (4 sources) · ATT&CK S0341 | |
| XorDDoS | XorDdos | Full page | detects, advises rebuild | our research (5 sources) |
Entries marked ATT&CK come from MITRE ATT&CK® (Enterprise 20.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.