Operation Windigo (Campaign)

Operation Windigo is a large Linux server-side credential-stealing malware campaign that compromised servers to deploy backdoors, rootkits and credential-harvesting components, forming a botnet and enabling wide-scale abuse of stolen credentials and traffic. The report provides technical analysis, IOC listings and descriptions of attacker tradecraft and infrastructure.