TF-MAL-elf.xanthe

Description

ThreatFox malware family `elf.xanthe`. Printable name: Xanthe.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• FBI warns of ATM jackpotting surge | Cybernews
  web:cybernews.com

  The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.

  2026-05-22 05:24 UTC
• Remediate vulnerabilities with Microsoft Defender Vulnerability ...
  web:learn.microsoft.com

  Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.

  2026-05-22 05:24 UTC
• Xanthe (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the Xanthe malware family including references, samples and yara signatures.

  2026-05-22 05:24 UTC
• Hackers Stole $20 Million by Forcing ATMs to Spit Out Cash
  web:www.bitdefender.com

  According to the advisory (FLASH-20260219-001), cybercriminals are increasingly deploying sophisticated malware — particularly variants of the Ploutus family — to force Automated Teller Machines (ATMs) to dispense cash without any legitimate transaction or bank authorization.

  2026-05-22 05:24 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Malware incident response is the coordinated process of identifying, containing, eradicating, and recovering from malware infections. It includes isolating infected systems, analyzing the malware's behavior, remediating affected accounts, and implementing controls to prevent reinfection.

  2026-05-22 05:24 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:24 UTC
• Xanthe Cryptomining Botnet Threat Intel Advisory - CloudSEK
  web:www.cloudsek.com

  Xanthe is a cryptomining botnet capable of compromising Docker servers whose API is exposed to the Internet. Xanthe targets Linux systems and is multi-modular. Their functionalities are defined in separate modules, in which the actual payload is a variant of XMRig crypto miner. The malware can infect multiple hosts by stealing client-side certificates to initiate spreading via Secure Shell ...

  2026-05-22 05:24 UTC
• Xanthe Malware Removal Report - EnigmaSoft Ltd
  web:www.enigmasoftware.com

  The Xanthe Malware is a multi-modular botnet and a malware threat that exploits incorrectly configured Docker API installations to infect Linux systems. Once inside, Xanthe deploys a variant of the popular XMRig Monero cryptomining malware and harvest client-side credentials and certificates, which it uses to propagate itself.

  2026-05-22 05:24 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-22 05:24 UTC
• Xanthe malware spreads using systems with exposed Docker API [Warning]
  web:xopero.com

  Xanthe malware targets misconfigured Docker servers Xanthe is a Monero cryptomining botnet, which has been exploiting incorrectly configured Docker API installations in order to infect Linux systems. Typically crypto miners attack Windows desktop systems - because the number of possible infection is much larger. But with the growth of cloud environments, there are more and more hosts on the ...

  2026-05-22 05:24 UTC

Only Available for Registered Users. Sign in to view.