TF-MAL-elf.plague
📛 Threat Title
Malware family: Plague
Description
ThreatFox malware family `elf.plague`. Printable name: Plague.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.plague
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.plague
IOC database
- Type
- domain
- Value
elf.plague- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.plague
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.plague
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.tmcnet.com
Broader Security Implications While Plague currently targets Linux systems, it's part of a growing trend toward "fileless" and "living off the land" malware techniques. Rather than relying on external binaries or trojans, these attacks exploit legitimate system tools or integrate into trusted authentication paths to hide in plain sight.
-
web:cybersecdemystify.com
This plan outlines the procedures to follow in the event of malware infection to minimize damage, recover systems, and prevent future incidents.
-
web:linuxsecurity.com
Plague is a stealthy PAM-based backdoor targeting Linux systems, enabling persistent SSH access and challenging detection efforts.
-
web:windowsforum.com
The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.csoonline.com
A malicious PAM module, undetected by VirusTotal, embedded itself in the login process, granting covert access and resisting upgrades.
-
web:www.ncsc.gov.uk
This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection
-
web:www.nextron-systems.com
Conclusion The Plague backdoor represents a sophisticated and evolving threat to Linux infrastructure, exploiting core authentication mechanisms to maintain stealth and persistence. Its use of advanced obfuscation, static credentials, and environment tampering makes it particularly difficult to detect using conventional methods.
-
web:www.nopalcyber.com
Malware Name: Plague . Plague is designed for long-term stealth and persistence, embedding itself within Linux authentication workflows by modifying or replacing legitimate PAM modules. Once deployed, the malware intercepts login attempts to capture user credentials, which are exfiltrated to the attacker-controlled infrastructure.
-
web:www.techradar.com
Pro Security New malware avoids antivirus detection, unleashes a " plague " on your devices News By Sead Fadilpašić published August 5, 2025
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.