Windigo
Windigo is a nation-state APT group with an espionage motive, tracked by Brandefense. It uses 7 MITRE ATT&CK techniques.
- Techniques
- 7
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2011
- Last seen
- Jun 4, 2019
- Record updated
About Windigo.
The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.
Last updated Jun 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.