TF-MAL-elf.notrobin

Description

ThreatFox malware family `elf.notrobin`. Printable name: NOTROBIN. Aliases: remove_bds.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Vigilante Deploying Mitigation for Citrix NetScaler Vulnerability While ...
  web:cloud.google.com

  Within these, something caught our eye: one particular threat actor that's been deploying a previously-unseen payload for which we've created the code family NOTROBIN . Upon gaining access to a vulnerable NetScaler device, this actor cleans up known malware and deploys NOTROBIN to block subsequent exploitation attempts!

  2026-05-22 02:10 UTC
• Malware: How To Protect Against, Detect, and Remove It
  web:consumer.ftc.gov

  Malware is one of the biggest threats to the security of your computer, tablet, phone, and other devices. Learn how to protect yourself, how to tell if your device has malware , and how to remove it.

  2026-05-22 02:10 UTC
• NOTROBIN (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  FireEye states that NOTROBIN is a utility written in Go 1.10 and compiled to a 64-bit ELF binary for BSD systems. It periodically scans for and deletes files matching filename patterns and content characteristics. The purpose seems to be to block exploitation attempts against the CVE-2019-19781 vulnerability; however, FireEye believes that NOTROBIN provides backdoor access to the compromised ...

  2026-05-22 02:10 UTC
• Hackers patch Citrix servers to deploy their own backdoor
  web:securityaffairs.com

  "One particular threat actor that's been deploying a previously-unseen payload for which we've created the code family NOTROBIN ." reads a report published by FireEye. "Upon gaining access to a vulnerable NetScaler device, this actor cleans up known malware and deploys NOTROBIN to block subsequent exploitation attempts!

  2026-05-22 02:10 UTC
• Hackers Are Securing Citrix Servers, Backdoor Them for Access
  web:www.bleepingcomputer.com

  An unknown threat actor is currently scanning for and securing vulnerable Citrix ADC servers against CVE-2019-19781 exploitation attempts, while also backdooring them for future access.

  2026-05-22 02:10 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 02:10 UTC
• FireEye Finds Mitigation of CVE-2019-19781 Comes With a Price
  web:www.darkreading.com

  FireEye has found evidence of an actor first breaching unmitigated Citrix ADC servers, installing a mitigation patch for CVE-2019-19781 and then deploying a new malware payload they call NOTROBIN .

  2026-05-22 02:10 UTC
• PDF Increase in Malware Enabled ATM Jackpotting Incidents Across United States
  web:www.ic3.gov

  Overview Threat actors are deploying ATM jackpotting malware , including the Ploutus family malware , to infect ATMs and force them to dispense cash. Ploutus malware exploits the eXtensions for Financial Services (XFS), the layer of software that instructs an ATM what to physically do. When a legitimate transaction occurs, the ATM application sends instructions through XFS for bank authorization ...

  2026-05-22 02:10 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-22 02:10 UTC
• Attacker Installs Backdoor, Blocks Others From Exploiting Citrix ADC ...
  web:www.securityweek.com

  One of the attacks that stands out from the crowd, FireEye says, is cleaning up known malware from the vulnerable deployments and deploys a previously-unseen payload known as NOTROBIN . The malware blocks subsequent exploitation attempts, but also maintains backdoor access, likely in preparation for a future campaign.

  2026-05-22 02:10 UTC

Only Available for Registered Users. Sign in to view.