TF-MAL-elf.redxor

Description

ThreatFox malware family `elf.redxor`. Printable name: RedXOR.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• How to identify and resolve the RedXOR malware attack?
  web:access.redhat.com

  Is my RHEL system affected by the RedXOR malware attack? How can I verify the malware on my RHEL system?

  2026-05-22 05:23 UTC
• MalwareBazaar | RedXOR
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as RedXOR .

  2026-05-22 05:23 UTC
• Detect C2 'RedXOR' With State-Based Functionality | Corelight
  web:corelight.com

  A very interesting Linux-based command-and-control (C2) malware was described by the research team at Intezer. Here are a few points about this malware .

  2026-05-22 05:23 UTC
• New GitHub Scam With Thousand of "mods" & "cracks" Steal Your Data
  web:cybersecuritynews.com

  A sophisticated malware operation exploiting GitHub's repository system has been uncovered, leveraging fake software cracks and gaming mods.

  2026-05-22 05:23 UTC
• Linux Backdoor RedXOR Likely Operated by Chinese Nation-State - Intezer
  web:intezer.com

  We discovered a new sophisticated backdoor targeting Linux endpoints and servers Based on Tactics, Techniques, and Procedures (TTPs) the backdoor is believed to be developed by Chinese nation-state actors The backdoor masquerades itself as polkit daemon. We named it RedXOR for its network data encoding scheme based on XOR. The malware was compiled on Red Hat Enterprise Linux We provide ...

  2026-05-22 05:23 UTC
• RedXOR (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  RedXOR is a sophisticated backdoor targeting Linux systems disguised as polkit daemon and utilizing network data encoding based on XOR. Believed to be developed by Chinese nation-state actors, this malware shows similarities to other malware associated with the Winnti umbrella threat group.

  2026-05-22 05:23 UTC
• PDF Shades of Red: Redxor Linux and Its Chinese Origins
  web:vblocalhost.com

  During our investigation we experienced an 'on and off' availability of the command-and-control (C2) server, indicating that the operation was active. In this paper we will explain in depth the attribution of RedXOR to Chinese advanced threat actors and provide a deep technical analysis of the malware .

  2026-05-22 05:23 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:23 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:23 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  How to defend organisations against malware or ransomware attacks.

  2026-05-22 05:23 UTC

Only Available for Registered Users. Sign in to view.