Windigo
IntrusionSet · ATTACK:enterprise:G0124
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0124",
"title": "Windigo",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0124",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--4e868dad-682d-4897-b8df-2dc98f46c68a",
"external_id": "G0124",
"domain": "enterprise",
"created": "2021-02-10T19:57:38.042Z",
"modified": "2026-07-31T18:47:55.695Z",
"version": "1.0",
"aliases": [
"Windigo"
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET Windigo Mar 2014",
"url": "https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"
},
{
"source_name": "CERN Windigo June 2019",
"url": "https://security.web.cern.ch/advisories/windigo/windigo.shtml"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06ae1d46-2349-457e-817b-e9fdca2f7768
ESET ForSSHe December 2018ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24b8eeb2-ee0d-402b-b2e0-afaa3c867072
ESET ForSSHe December 2018ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39c98d86-3f44-4a47-b7e5-4cb3e4bf97a7
ESET ForSSHe December 2018ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:S0377
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66a73f1e-dfb8-4509-be62-787c9a14c221
ESET Ebury Oct 2017ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c776fbc-592a-4643-bd4f-423546a4732e
ESET Windigo Mar 2014ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bea0bf7c-62c8-4334-b523-5cc6ec8b36c8
ESET ForSSHe December 2018ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2116500-b22a-44f6-ad5b-c3e579a67491
ESET ForSSHe December 2018ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f983de6b-eb17-4947-b4b0-50bd530f50e3
ESET Windigo Mar 2014