BifrostMalware
- elf.bifrose
Linux version of the bifrose malware that originally targeted Windows platform only. The backdoor has the ability to perform file management, start or end a process, or start a remote shell. The connection is encrypted using a modified RC4 algorithm.From MISP Galaxy
Last reported 25 days ago, by SecurityWeek3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1036Masquerading
“…with Malicious LNK Lures — The North Korean threat group known as Konni has been observed using ZIP archives with malicious LNK files masquerading as PDF documents as lures in spear-phishing attacks targeting Ukraine-focused individuals and organizations to deliver a malware call…”
- T1053.005Scheduled Task
“The LNK file launches a VBScript that establishes persistence via a scheduled task, and triggers a PowerShell script to run every minute.”
- T1195Supply Chain Compromise
“…allow a complete takeover of the target organization, or code execution on its internal infrastructure, with or without further supply-chain compromise."”
- T1552.004Private Keys
“Hundreds of Leaked GitHub App Keys Still Active — A new analysis from GitGuardian has found that hundreds of GitHub App private keys leaked in public code still work.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Rig Security Emerges From Stealth With $12M to Tackle Agentic AI Identity Risks“There are two primary components to the Rig solution: RICE (Rig identity correlation engine) and Bifrost (its endpoint sensor).”
-
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats“…026-89775 (Linux kernel), CVE-2026-93616, CVE-2026-85102 (Check Point), CVE-2026-93952 (Arista VeloCloud Orchestrator), CVE-2026-90898 (Bifrost), CVE-2026-86555, CVE-2026-86554, CVE-2026-86553, CVE-2026-86552 (ZTE H188A/H288A firmware), CVE-2026-94545 (Next.js), CVE-2026-94127 (F…”
-
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials“Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials”
Indicators in its reports
named in the reports above- third-party[.]comin 1 report
- fbijobs[.]govin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.