We uncovered key similarities between RedXOR and previously reported malware associated with Winnti umbrella threat group. These malware are PWNLNX backdoor and XOR.DDOS and Groundhog, two botnets attributed to Winnti by BlackBerry.
XorDDoS
XorDDoS, also known as XOR.DDoS, is a Linux DDoS botnet malware family first identified in 2014.
Profile source: Mallory opens in a new tabXorDDoS
Family profile
XorDDoS, also known as XOR.DDoS, is a Linux DDoS botnet malware family first identified in 2014. It primarily compromises Linux servers and other Linux devices through SSH credential brute-forcing, including exposed Docker environments, and installs an ELF payload after obtaining privileged access. It has targeted x86, x64, and ARM systems.
The malware establishes durable execution through System V init/runlevel services and cron jobs. Variants copy themselves to alternative locations, delete installation artifacts and logs, alter process names, terminate competing malware, and modify binary content to impede hash-based detection. XorDDoS uses XOR-obfuscated configuration and command-and-control communications, and gathers host, processor, memory, operating-system, network, and process information.
Many variants include or retrieve a kernel-version-specific loadable-kernel-module rootkit, with code lineage linked to Suterusu and Rooty. The rootkit can conceal the malware's processes, module, network ports, and TCP/UDP connections. XorDDoS can receive commands to launch SYN, ACK, and DNS flooding attacks; download and execute additional payloads; update itself; report system information; and remove competing processes or files.
Recent analysis attributes the operators with high confidence to Chinese-speaking individuals based on language artifacts in associated builder and controller tooling. XorDDoS activity has been globally distributed, with substantial observed targeting and victim concentration in the United States during late 2023 through early 2025.
Capabilities
- Brute Force
- Ddos
- Defense Evasion
- Persistence
- Post Exploitation
- Reconnaissance
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
XorDDoS in ATT&CK
45 distinct techniquesTechniques
45 techniques T1053.003 Cron T1057 Process Discovery T1071.001 Web Protocols T1543 Create or Modify System Process T1497 Virtualization/Sandbox Evasion T1498 Network Denial of Service T1070.004 File Deletion T1059.004 Unix Shell T1082 System Information Discovery T1027 Obfuscated Files or Information T1105 Ingress Tool Transfer T1110 Brute Force T1070 Indicator Removal T1110.001 Password Guessing T1014 Rootkit T1036 Masquerading T1059 Command and Scripting Interpreter T1071 Application Layer Protocol T1037 Boot or Logon Initialization Scripts T1083 File and Directory Discovery T1556 Modify Authentication Process T1037.004 RC Scripts T1543.001 Launch Agent T1041 Exfiltration Over C2 Channel T1564.001 Hidden Files and Directories T1564.003 Hidden Window T1078 Valid Accounts T1033 System Owner/User Discovery T1613 Container and Resource Discovery T1560 Archive Collected Data T1090.003 Multi-hop Proxy T1498.001 Direct Network Flood T1016 System Network Configuration Discovery T1095 Non-Application Layer Protocol T1489 Service Stop T1001 Data Obfuscation T1046 Network Service Discovery T1498.002 Reflection Amplification T1564.010 Process Argument Spoofing T1573 Encrypted Channel T1190 Exploit Public-Facing Application T1072 Software Deployment Tools T1055 Process Injection T1218 System Binary Proxy Execution T1021.004 SSH
Reporting
Research mentioning XorDDoS
Jan 1
Intezer
Linux Backdoor RedXOR Likely Operated by Chinese Nation-State
Researchers identified RedXOR, a Linux backdoor disguised as a polkit daemon, and assessed it was likely operated by a Chinese nation-state actor based on victimology, tactics, and code overlaps with malware associated with the Winnti umbrella. The malware targets Linux endpoints and servers, persists through init scripts, and uses the Adore-ng LKM rootkit for stealth. It supports host reconnaissance, file manipulation, remote shell access, self-update and uninstall functions, rootkit deployment, and network tunneling through a modified Rinetd component. RedXOR communicates with command-and-control infrastructure over TCP traffic made to resemble HTTP and uses XOR-based encoding to obscure data in transit. Researchers reported low antivirus detection and observed sample uploads from Taiwan and Indonesia, while intermittent command-and-control availability suggested the operation was active during analysis. The activity was framed against broader reporting on Chinese intrusion groups, including archived references to APT41 and long-running Chinese cyber-espionage operations, reinforcing the assessment that RedXOR fits an established pattern of Linux-focused tooling used in state-linked campaigns.
May 19
Microsoft General
Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices | Microsoft Security Blog
XOR.DDoS has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch SYN flood, ACK flood, and DNS amplification attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, Groundhog, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a loadable kernel module rootkit to hide processes and TCP ports, and survive reboots through files and scripts placed in /boot, /etc/init.d, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the Tsunami backdoor and XMRig miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Sep 25
Bartblaze
Blaze's Security Blog: Notes on Linux/Xor.DDoS
Jan 6
Avast
