Windigo, also known as Operation Windigo and G0124, is a financially motivated cybercriminal group that emerged in at least 2011. This group is distinguished by its exclusive focus on compromising Linux and Unix servers, establishing large botnets for credential theft, spam distribution, web traffic redirection, and cryptocurrency theft. Unlike many threat actors, Windigo primarily operates at a low system level, employing modified binaries, abstract UNIX sockets, and library injection for stealth. The group maintains a modular malware infrastructure and has continuously evolved its tooling and infection vectors, even after law enforcement interventions.

Sectores atacados