Operation Windigo (Malware)

A collection of malware developed to create a sophisticated network of botnets that can distribute spam, redirect Web traffic and infect users’ computers with malware, all while keeping the location of the cyber criminals perpetrating the attacks a secret.

Operation Windigo is believed to have been growing behind the scenes for the past three years. It gained public attention in March 2014, when software security firm ESET revealed it was responsible for compromising more than 25,000 Linux servers. At one point during this time the Windigo network was sending 35 million daily spam messages and redirecting more than 500,000 web visitors to exploits kits each day, according to ESET.

Operation Windigo primarily relies on two Linux backdoors, Linux/Ebury and Linux/Cdorked, to steal login credentials, compromise Web servers and redirect traffic. Notable victims of Operation Windigo have included cPanel, a popular web hosting control panel platform, and kernel.org.

How to Identify and Clean a System Compromised by Windigo

ESET researchers dubbed the network Windigo after a mythical cannibalistic creature of Algonquian Native American folklore. The security firm recommends administrators and webmasters run the following command to identify if their server has been compromised by Operation Windigo:

$ ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo System clean || echo System infected

Servers infected by Operation Windigo should be wiped completely clean and have their operating system and applications reinstalled. Unique passwords and private keys need to be created for future access to a previously infected system in order to help prevent the server from being compromised again.

Forrest Stroud
Forrest Stroud
Forrest is a writer for Webopedia. Experienced, entrepreneurial, and well-rounded, he has 15+ years covering technology, business software, website design, programming, and more.

Related Articles

AutoIt Scripting Language

AutoIt is a popular and easy-to-learn scripting language used by developers since 1999 for quick software development. Here’s more about AutoIt scripting language, its...

Sales CRM

A sales CRM, or customer relationship management (CRM) tool for sales, is frequently the centerpiece of sales operations for a variety of business use...

HighLevel CRM

HighLevel is a sales and marketing customer relationship management (CRM) solution designed by the company HighLevel. Because it's uniquely designed for marketing agencies, HighLevel...

CRM Manager

A customer relationship management (CRM) manager is a person that oversees all customer and client relations within a business. They specialize in customer interactions...

AutoIt Scripting Language

AutoIt is a popular and easy-to-learn scripting language used by developers since 1999...

HighLevel CRM

HighLevel is a sales and marketing customer relationship management (CRM) solution designed by...

Unified Endpoint Management (UEM)

As enterprise networks become increasingly distributed with growing numbers of remote workers, unified...