---

Malware Name / Type

• Name: XorDDoS (aka XOR DDoS)
• Type: Linux Trojan / DDoS botnet (rootkit-capable)

---

Quick Summary

• First Seen / Known Since: First publicly reported in 2014 (discovered by MalwareMustDie).
• Primary Targets / Industries: Linux servers, cloud instances, IoT devices, and container/Docker hosts.
• Geographic Focus: Global; historically heavy activity in Asia and frequent targeting of US-based infrastructure in recent waves.

---

Infection & Distribution

• Common Delivery Vectors: SSH brute-force / credential compromise, automated scanning of exposed services, malicious scripts dropped after initial access.
• Initial Access Methods: Brute-force or stolen SSH credentials, exploitation of exposed management interfaces, automated deployment scripts.

---

Technical Characteristics

• Platform / Language: Multi-architecture Linux ELF binaries (x86, x64, ARM); often accompanied by shell scripts for installation.
• Persistence Mechanisms: Multiple-install-step approach including installing rootkit components, cron/jobs, service wrappers and use of scripts to re-deploy persistence across reboots.
• Command & Control (C2): Encrypted communications often using simple XOR-based obfuscation; C2 infrastructure has evolved and includes resilient controller nodes and domain/IP patterns.
• Capabilities: High-capacity volumetric DDoS (various UDP/TCP/HTTP flood techniques), remote command execution, bot management, and sometimes lateral scanning for new victims.
• Evasion Techniques: XOR obfuscation of strings/traffic, rootkit hiding to conceal files/processes, multi-stage installers that complicate detection and attribution.

---

Notable Campaigns / Incidents

• Historic wave (2014–2015): Large brute-force campaigns that initially brought XorDDoS to light.
• Resurgence / recent waves (2019–2025): Periodic resurgences with improved controllers and infrastructure; researchers documented a notable wave and new controller activity between late 2023 and early 2025.

---

Impact Assessment

• Damage Potential: Medium to High. Primarily contributes to large-scale DDoS campaigns; infected hosts are turned into bots and can cause significant service disruption or be rented/sold for DDoS-for-hire.
• Typical Victim Impact: Service downtime, increased bandwidth costs, potential secondary compromises if credentials are reused.

---

Indicators & Artifacts

• Malware Samples:
  • https://bazaar.abuse.ch/browse.php?search=tag%3A+XORDDoS
  • https://www.virustotal.com/gui/file/09898756f3e900900093fe4890680734f41ece38362912f4da2a3994a12a833e
• Suspicious Domains / IPs: Coming Soon
• Common Filenames / Paths: Often installs via /tmp or /var/tmp with temporary script names; look for suspicious shell scripts, unexpected cron entries, or kernel module artifacts.
• YARA / Detection Snippets: Look for XOR-deobfuscation routines, ELF sections with suspicious strings obfuscated by XOR, or known command patterns from community rules.

---

Detection & Mitigation

• Detection Tips: Monitor for high outbound DDoS traffic, sudden SSH login failures/successes (brute-force patterns), unexpected long-running ELF processes, hidden files/modules, and unusual cron/service entries.
• Immediate Mitigation Steps: Isolate infected hosts from network, revoke SSH keys/passwords, rotate credentials, remove malicious persistence, patch exposed services, and restore from known-good images if rootkit compromise suspected.
• Longer-term Recommendations: Harden SSH (disable password auth, use keys with MFA, rate-limit/geo-block where possible), apply least-privilege, enable host-based monitoring/EPP with rootkit detection, block known C2 domains/IPs at perimeter, and maintain IR playbooks for botnet infections.

WriteUp & Useful Resources

• Incident Response Report: XorDDoS Trojan Detected
  https://github.com/barubary17/Incident-Response-to-XorDDoS-Malware

• https://bartblaze.blogspot.com/2015/09/notes-on-linuxxorddos.html
• https://www.fireeye.com/blog/threat-research/2015/02/anatomy_of_a_brutef.html
• https://blog.malwaremustdie.org/2014/09/mmd-0028-2014-fuzzy-reversing-new-china.html
• https://blog.malwaremustdie.org/2015/06/mmd-0033-2015-linuxxorddos-infection_23.html
• https://blog.malwaremustdie.org/2015/07/mmd-0037-2015-bad-shellshock.html
• https://blog.malwaremustdie.org/2015/09/mmd-0042-2015-polymorphic-in-elf.html
• https://malpedia.caad.fkie.fraunhofer.de/details/elf.xorddos
• https://unit42.paloaltonetworks.com/new-linux-xorddos-trojan-campaign-delivers-malware
• https://www.microsoft.com/en-us/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices
• https://blog.talosintelligence.com/unmasking-the-new-xorddos-controller-and-infrastructure
• https://thehackernews.com/2025/04/experts-uncover-new-xorddos-controller.html
• https://research.splunk.com/stories/xorddos/
• https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html
• https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/malware/elf_xorddos.txt