Ebury

Ebury is a sophisticated malware that has been causing havoc in the cyber world for over 15 years, with its main target being Linux servers. The first significant investigation into Ebury was conducted by ESET in 2014, revealing it as a key component of Operation Windigo. Ten years later, this threat remains potent, having compromised nearly 400,000 servers since 2009. The malware's reach has expanded beyond disruption and data theft to include financial exploitation through credit card and cryptocurrency theft. The Ebury botnet has evolved significantly over time, adding new features and expanding its toolkit for monetization. Despite infecting around 25,000 servers initially, recent findings suggest that the malware has developed advanced functionalities focusing on financial gain. If system administrators sanitize their infected servers, there's a risk that the cybercriminals behind Ebury could reinstall the malware if compromised credentials are reused. In response to the persistent threat, ESET released detection and remediation tools to help system administrators identify and deal with Ebury compromises. The Dutch National High Tech Crime Unit (NHTCU) discovered Ebury on a victim's server during a cryptocurrency theft investigation in 2021. This led to increased scrutiny of the malware and its operators. In 2015, one of the key individuals behind Ebury, Russian citizen Maxim Senak, was arrested at the Finland-Russia border and extradited to the US. Since then, remaining Ebury masterminds have maintained a low profile, but the malware continues to pose a substantial threat.