The Winnti malware family was first reported in 2013 by Kaspersky Lab. Since then, threat actors leveraging Winnti malware have victimized a diverse set of targets for varied motivations.

The underlying hypothesis is that the malware itself may be shared (or sold) across a small group of actors. Clusters of Winnti-related activity have become a complex topic in threat intelligence circles, with activity vaguely attributed to different codenamed threat actors.

This whitepaper provides a technical analysis of a small cluster of Winnti samples designed specifically for Linux.