Operation Windigo
Linked to Russia by one source.
Reports per quarter
CVEs named in reports
- CVE-2012-5687
- CVE-2014-4404 KEV
- CVE-2014-8361 KEV
- CVE-2014-9583
- CVE-2015-1130 KEV
- CVE-2015-1635 KEV
- CVE-2015-2051 KEV
- CVE-2016-5195 KEV
- CVE-2017-0262 KEV
- CVE-2017-0263 KEV
- CVE-2017-11882 KEV ransomware
- CVE-2017-5638 KEV ransomware
Show all 29 CVEs Show fewer
- CVE-2018-10562 KEV ransomware
- CVE-2018-14847 KEV
- CVE-2019-0708 KEV ransomware
- CVE-2019-11510 KEV ransomware
- CVE-2019-3978
- CVE-2020-0796 KEV ransomware
- CVE-2021-26855 KEV ransomware
- CVE-2021-26857 KEV ransomware
- CVE-2021-26858 KEV ransomware
- CVE-2021-27065 KEV ransomware
- CVE-2021-31207 KEV ransomware
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
- CVE-2021-36934 KEV
- CVE-2021-38647 KEV ransomware
- CVE-2021-44228 KEV ransomware
- CVE-2021-45467
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t32021
-
Microsoft Word - glupteba_final.docx
The original link failed its last check. Original publisher Detailsfor Microsoft Word - glupteba_final.docx
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Kobalos
-
Glupteba Hits Routers and Updates C&C Servers
The original link failed its last check. Original publisher Detailsfor Glupteba Hits Routers and Updates C&C Servers
-
Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions
-
Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions
Show all 26 reports Show fewer
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advisory- Windigo attacks
-
2019-06-04 Advisory- Windigo attacks
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor 2019-06-04 Advisory- Windigo attacks
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Dark Side of the ForSSHe
-
Glupteba is no longer part of Windigo
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Glupteba is no longer part of Windigo
-
Windigo Still not Windigone- An Ebury Update
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Windigo Still not Windigone- An Ebury Update
-
BSI - IT Security Situation in Germany - 2014 (DE).pdf
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BSI - IT Security Situation in Germany - 2014 (DE).pdf
-
Operation Windigo- “Good job, ESET!” says malware author
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Windigo- “Good job, ESET!” says malware author
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign
Newest first. Details opens the report in Explore.