TF-MAL-elf.capoae

Description

ThreatFox malware family `elf.capoae`. Printable name: Capoae.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Capoae (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  XMRig-based mining malware written in Go. 2021-09-16 ⋅ Akamai ⋅ Larry Cashdollar Capoae Malware Ramps Up: Uses Multiple Vulnerabilities and Tactics to Spread Capoae

  2026-05-22 01:27 UTC
• eBPF: A new frontier for malware - Red Canary
  web:redcanary.com

  Extended Berkeley Packet Filter (eBPF) is beginning to transform the Linux malware landscape. Here's what defenders should look out for.

  2026-05-22 01:27 UTC
• Capoae Malware Ramps Up: Uses Multiple Vulnerabilities and ... - Akamai
  web:www.akamai.com

  Recently, there has been a plethora of UPX packed crypto-mining malware written in Golang targeting Linux systems and web applications popping up in the news. The malware's primary tactic is to spread by taking advantage of vulnerable systems and weak administrative credentials. Once they've been infected, these systems are then used to mine cryptocurrency. I've named the sample I ...

  2026-05-22 01:27 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 01:27 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 01:27 UTC
• Capoae Malware Removal Report - EnigmaSoft Ltd
  web:www.enigmasoftware.com

  A new malware strain is being used in active attack campaigns to deliver crypto-mining payloads onto compromised systems. The threat was named Capoae , and, according to the findings, Capoae is written using the Go language, which is becoming a popular choice in cybercriminal circles due to its cross-platform capabilities. As initial vectors of compromise, the threat actors employ brute-force ...

  2026-05-22 01:27 UTC
• New eBPF Filters for Symbiote and BPFdoor Malware
  web:www.fortinet.com

  FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.

  2026-05-22 01:27 UTC
• CVE-2026-31431 Copy Fail Explained: IOCs and Patch Guide
  web:www.kodemsecurity.com

  CVE-2026-31431, the Copy Fail Linux kernel LPE, lets authenticated users gain root. See affected kernels, exploit details, IOCs and patches.

  2026-05-22 01:27 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  How to defend organisations against malware or ransomware attacks.

  2026-05-22 01:27 UTC
• (PDF) eBPF-based Malware - ResearchGate
  web:www.researchgate.net

  Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...

  2026-05-22 01:27 UTC

Only Available for Registered Users. Sign in to view.