Trusted Design

A Look Into Fysbis: Sofacy’s Linux Backdoor

概要

The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia. Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments. There have been numerous reports on their activities, to the extent that a Wikipedia entry has even been created for them. The Linux malware Fysbis is a preferred tool of Sofacy, and though it is not particularly sophisticated, Linux security in general is still a maturing area, especially in regards to malware. In short, it is entirely plausible that this tool has contributed to the success of associated attacks by this group. This blog post focuses specifically on this Linux tool preferred by Sofacy and describes considerations and implications when it comes to Linux malware.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• A Look Into Fysbis: Sofacy’s Linux Backdoor (score: 0.88)
• 20160212B: Sofacy’s Linux Backdoor (score: 0.71)
• BlackEnergy by the SSHBearDoor (score: 0.70)
• New wave of cyberattacks against Ukrainian power industry (score: 0.65)
• New Trojan for Linux infects routers (score: 0.65)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る