TF-MAL-elf.chisel
📛 Threat Title
Malware family: Chisel
Description
ThreatFox malware family `elf.chisel`. Printable name: Chisel.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.chisel
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.chisel
IOC database
- Type
- domain
- Value
elf.chisel- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.chisel
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.chisel
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.netmanageit.com
The Infamous Chisel malware is being investigated by the United States National Security Agency (CISA), which is working with the Australian National Cyber Security Centre (NCSC), New Zealand and Australia.
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:cybersecuritynews.com
Cybercriminals use tools like PoshC2 & Chisel to target African banks, blending attacks with admin tasks to evade detection.
-
web:github.com
The Chisel library is required for us to establish a reverse tunnel to Edge Agent environments, and is being falsely identified as malicious by Defender. You can find in-depth discussion of this kind of flagging happening before to Chisel in their GitHub repo.
-
web:malpedia.caad.fkie.fraunhofer.de
Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go.
-
web:nsarchive.gwu.edu
CISA: Infamous Chisel Malware Analysis Report Open PDF in new window View OCR of the document of 0
-
web:www.cisa.gov
Infamous Chisel-A collection of components associated with Sandworm designed to enable remote access and exfiltrate information from Android phones. Executive Summary Infamous Chisel is a collection of components targeting Android devices. This malware is associated with Sandworm activity.
-
web:www.ncsc.govt.nz
Malware summary Infamous Chisel is a collection of components which enable persistent access to an infected Android device over the Tor network, and which periodically collates and exfiltrates victim information from compromised devices. The information exfiltrated is a combination of system device information, commercial application information and applications specific to the Ukrainian military.
-
web:www.nsa.gov
U.S. federal agencies and international partners published a report warning of a new malware campaign from Russian military cyber actors known publicly as Sandworm.
-
web:www.securitymagazine.com
The malware analysis report provides technical details of a new kind of malware used to target Android devices in use by Ukrainian military personnel. The malware , called Infamous Chisel , enables unauthorized access to compromised devices and is designed to scan files, monitor traffic and periodically steal sensitive information.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.