Glupteba

Overview

Glupteba (extensively researched and documented across the cybersecurity community and prominently disrupted by Google's Threat Analysis Group in December 2021 as Trojan:Win32/Glupteba, Backdoor:Win32/Glupteba, and Win32/Glupteba) is a landmark, highly sophisticated modular botnet active since 2011. Renowned for being one of the first crimeware botnets to leverage the public Bitcoin blockchain as a resilient fallback command-and-control mechanism, Glupteba regularly reads OP_RETURN data from specific Bitcoin wallet transactions to dynamically retrieve updated C2 server domain names and IP addresses, bypassing traditional DNS takedowns and IP blacklisting. Glupteba targets Windows endpoints, enterprise networks, and MikroTik routers, deploying modular capabilities including illicit cryptocurrency mining (Monero), stealing browser credentials and cookies, establishing residential proxy networks, launching distributed denial-of-service (DDoS) attacks, and deploying a signed vulnerable driver (a rootkit technique known as BYOVD - Bring Your Own Vulnerable Driver) to terminate endpoint security processes.

Known aliases

Threat reports may refer to this family under multiple names:

• Trojan:Win32/Glupteba
• Backdoor:Win32/Glupteba
• Win32/Glupteba
• Trojan.Glupteba
• Glupteba Botnet
• Backdoor.Win32.Glupteba

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Glupteba V1 · Glupteba V2 (Blockchain Enabled) · Trojan:Win32/Glupteba.Gen

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1071.001 · T1068 · T1562.001 · T1496 · T1555.003 · T1090

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_GLUPTEBA_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Glupteba"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "glupteba" ascii wide nocase
        $s2 = "trojan:win32/glupteba" ascii wide nocase
        $s3 = "backdoor:win32/glupteba" ascii wide nocase
        $s4 = "win32/glupteba" ascii wide nocase
        $s5 = "trojan.glupteba" ascii wide nocase
        $s6 = "glupteba botnet" ascii wide nocase
        $s7 = "backdoor.win32.glupteba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Glupteba (Botnet) Execution & Triage
id: 483f1f81-e0d3-567e-a07c-2ccf3f674cc4
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Glupteba malware family. Detects firewall rule subversion, internal port
  proxying, and command-and-control keepalive polling indicative of botnet nodes.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/glupteba
- https://malware-families-catalog.systemhelpdesk.com/defensive/botnet-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.botnet
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1071_001
- attack.t1068
- attack.t1562_001
- attack.t1496
- attack.t1555_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \netsh.exe
    - \route.exe
    - \arp.exe
    - \ping.exe
    CommandLine|contains:
    - advfirewall firewall add rule
    - netsh interface portproxy
    - ping -n 1 127.0.0.1
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_GLUPTEBA_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Glupteba tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "glupteba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

References & External Analysis

• Google Threat Analysis Group (TAG) - Disrupting the Glupteba Botnet
• CISA Advisory - Multi-Platform Botnet Threats: Glupteba
• Trend Micro Research - The Glupteba Botnet: An In-Depth Look at Blockchain-Enabled Malware
• CISA Advisory: https://www.cisa.gov
• Search "glupteba" on VirusTotal (External Analysis)
• Search "glupteba" on Any.Run (Sandbox Sandbox)
• Search "glupteba" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: https://www.cisa.gov ↗

Frequently Asked Questions

Related Threats (Category: Botnet)

Explore other documented threats in the same operational category:

• Stantinko
• Dorkbot
• Mirai
• Simda
• Cybernetic
• Tordev
• Storm
• Palevo

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/glupteba.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.