operation_windigo.pdf

Operation Windigo is a long-running, large-scale criminal campaign that has compromised Linux/Unix servers worldwide (tens of thousands of hosts) to operate a multifunctional botnet: an OpenSSH backdoor (Linux/Ebury) that steals SSH credentials and provides persistent root access, an HTTP redirection backdoor (Linux/Cdorked) combined with a DNS backdoor (Linux/Onimiki) that funnels visitors to exploit kits, and a Perl-based spam module (Perl/Calfbot); the report includes technical internals, DGAs, shared-memory exfiltration methods, IOCs and cleaning/prevention guidance.