Linux Takeover Artists Fling 35M Spam Messages Daily

Operation Windigo server takeover campaign controls 10,000 hacked servers, launches millions of spam, malware, and drive-by exploit kit attacks per day

Beware a long-running Linux server compromise campaign thats being used to fling 35 million spam messages each day. The gang behind the attacks also controls a network of 700 compromised Web servers thats regularly used to steal secure shell (SSH) credentials and redirect 500,000 people per day to sites that host malicious content.
That warning was sounded Tuesday by security firm ESET, which has released an in-depth study of the so-called Operation Windigo attack campaign. According to our analysis, over 25,000 servers have been affected over the last two years. More than 10,000 of them are still infected today, said Pierre-Marc Bureau, security intelligence program manager for ESET, in a blog post. This number is significant if you consider each of these systems have access to significant bandwidth, storage, computing power, and memory. Well-known organizations such as cPanel and kernel.org were on the list of victims, although they have now cleaned their systems.
The gang behind Operation Windigo has relied on three homebuilt tools to handle the main parts of the malicious operation. Those tools include Ebury, which is a Linux-compatible OpenSSH backdoor that can be used to remotely steal credentials as well as control servers. It was installed on more than 25,000 servers that have been compromised and is still active on 10,000 servers. Attackers also built Cdorked, an HTTP backdoor, which runs on Apaches httpd, as well as the Nginx and lighttpd web servers, to redirect a servers web traffic. It often works in conjunction with a modified DNS server called Onimiki and currently infects about 700 servers. Finally, theyve created a Perl script called Calfbot, designed to send spam, which has infected systems running FreeBSD, Linux, Mac OS X, OpenBSD, and even Windows -- with Perl running via the Unix-like environment and command-line interface known as Cygwin.
Read the full article
here
.
Have a comment on this story? Please click Discuss below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Linux Takeover Artists Fling 35M Spam Messages Daily