TF-MAL-elf.kaiji

Description

ThreatFox malware family `elf.kaiji`. Printable name: Kaiji.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• MalwareBazaar | Kaiji
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as Kaiji .

  2026-05-22 02:08 UTC
• Advent of Configuration Extraction - Part 1: Kaiji Configuration ...
  web:blog.sekoia.io

  This article is the opening chapter of a four-part Advent of Configuration Extraction series. The series outlines the methodology we employ at Sekoia's Threat Detection & Research (TDR) team to automate the extraction of malware configuration data, from initial analysis to the production of usable intelligence. Each post of the series focuses on a different scenario, such as analysing .NET ...

  2026-05-22 02:08 UTC
• Kaiji (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples.

  2026-05-22 02:08 UTC
• Trellix Insights: Xorddos and Kaiji malware targeting Docker servers
  web:thrive.trellix.com

  Exposed Docker containers were targeted with malware capable of performing distributed denial of service attacks or turning the infected system into a botnet. The malicious software captured system details including running processes, CPU information, directories, and network data.

  2026-05-22 02:08 UTC
• How to Set Up Runtime Protection Against Malware Like Kaiji
  web:www.aquasec.com

  For more prevention and remediation strategies, including Aqua's Runtime Protection Policies, visit our Support Portal. Kaiji's Invisible Grip: How Persistence and Deception Keep It Alive Kaiji's authors have invested tremendous effort into staying on machines once they've gained access.

  2026-05-22 02:08 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 02:08 UTC
• Kaiji malware: What it is, how it works and how to prevent it | Malware ...
  web:www.infosecinstitute.com

  Kaiji also compromises IoT devices. The origin of this malware is China and it is written in the Golang or Go programming language. Kaiji can be prevented by patching security flaws, using IPS and IDS, using robust lightweight cryptography for IoT, utilizing CDN and so on.

  2026-05-22 02:08 UTC
• New 'Kaiji' Botnet Attacks Linux, IoT Devices via SSH Brute Force
  web:www.securityweek.com

  The botnet, which security researcher MalwareMustDie , is of Chinese origin and spreads exclusively via SSH brute force attacks, targeting the root user only. Designed to launch distributed denial of service (DDoS) attacks, the malware requires root access to craft custom network packets and operate unhindered.

  2026-05-22 02:08 UTC
• Chaos Malware Quietly Evolves Persistence and Evasion Techniques - Sysdig
  web:www.sysdig.com

  Kaiji malware As far as behavioral attributes, we concur with previous reporting that this Chaos malware is an evolution of the Kaiji botnet, with much of the same previously reported functionality. To summarize, Kaiji was a DDoS botnet that mainly attacked IoT devices via SSH brute-forcing, hence the source language being Go and easy cross-compilation to common IoT architectures like PowerPC ...

  2026-05-22 02:08 UTC
• XORDDoS, Kaiji Variants Target Exposed Docker Servers
  web:www.trendmicro.com

  We detected variants of two Linux botnet malware - XORDDoS and Kaiji - targeting exposed Docker servers. XORDDoS infiltrated the Docker server to infect all containers it hosts, while the Kaiji attack used its own container with its DDoS malware .

  2026-05-22 02:08 UTC

Only Available for Registered Users. Sign in to view.