Skuggaheimar/Threat Intelligence/ELF ReverseSSH
ELF REVERSESSH
REVERSESSH
LINUX MALWARE
ECRIME / APT
Threat IntelligenceMalwareJuly 10, 2025•15 min read

ELF ReverseSSH: Threat Intelligence Profile

Linux reverse SSH backdoor

Scroll

ELF ReverseSSH (also known as ReverseSSH) is a linux malware active since 2021. Linux reverse SSH backdoor. Key characteristics include: Go-based reverse SSH tunnel, Linux persistence, used as post-exploitation backdoor.

Overview & Background

Linux reverse SSH backdoor. First identified in 2021, this threat is attributed to eCrime / APT.

Threat Assessment

ELF ReverseSSH remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this linux malware.

Technical Analysis

ELF ReverseSSH employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against ELF ReverseSSH

Mjolnir Security provides detection and response capabilities against ELF ReverseSSH and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for ELF ReverseSSH indicators and TTPs within your environment.
  • Threat Intelligence Monitor ELF ReverseSSH campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: July 10, 2025
Related Reports
Malware

Tofsee: Modular Spam Botnet

Read Report →
Malware

SystemBC: Ransomware Enabler

Read Report →