{
  "family": "glupteba",
  "sample_count": 32,
  "category": "botnet",
  "description": "Glupteba (extensively researched and documented across the cybersecurity community and prominently disrupted by Google's Threat Analysis Group in December 2021 as Trojan:Win32/Glupteba, Backdoor:Win32/Glupteba, and Win32/Glupteba) is a landmark, highly sophisticated modular botnet active since 2011. Renowned for being one of the first crimeware botnets to leverage the public Bitcoin blockchain as a resilient fallback command-and-control mechanism, Glupteba regularly reads OP_RETURN data from specific Bitcoin wallet transactions to dynamically retrieve updated C2 server domain names and IP addresses, bypassing traditional DNS takedowns and IP blacklisting. Glupteba targets Windows endpoints, enterprise networks, and MikroTik routers, deploying modular capabilities including illicit cryptocurrency mining (Monero), stealing browser credentials and cookies, establishing residential proxy networks, launching distributed denial-of-service (DDoS) attacks, and deploying a signed vulnerable driver (a rootkit technique known as BYOVD - Bring Your Own Vulnerable Driver) to terminate endpoint security processes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Glupteba",
    "Backdoor:Win32/Glupteba",
    "Win32/Glupteba",
    "Trojan.Glupteba",
    "Glupteba Botnet",
    "Backdoor.Win32.Glupteba"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Glupteba botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Glupteba is a sophisticated modular botnet that conducts cryptocurrency mining, steals credentials, sells proxy routing, and abuses the Bitcoin blockchain for C2 communication."
      }
    },
    {
      "@type": "Question",
      "name": "How does Glupteba abuse the Bitcoin blockchain for command and control?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Glupteba queries public Bitcoin blockchain transactions, extracting encoded C2 domain names and IP addresses embedded within OP_RETURN output fields."
      }
    },
    {
      "@type": "Question",
      "name": "How was the Glupteba botnet disrupted by Google?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In December 2021, Google's Threat Analysis Group (TAG) obtained a federal court order to seize key domains and infrastructure, disrupting millions of infected nodes."
      }
    },
    {
      "@type": "Question",
      "name": "What is Bring Your Own Vulnerable Driver (BYOVD) as used by Glupteba?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Glupteba drops legitimately signed third-party drivers with known security flaws to gain kernel-mode privileges and forcefully terminate antivirus software."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against Glupteba infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block known vulnerable driver hashes via Microsoft Driver Blocklist, monitor for unauthorized Monero mining, patch MikroTik routers, and deploy behavioral EDR agents."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1071.001",
    "T1068",
    "T1562.001",
    "T1496",
    "T1555.003",
    "T1090"
  ],
  "cisa_advisory": "https://www.cisa.gov",
  "last_updated": "2026-10-15",
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Pay-Per-Install Networks",
    "Trojanized Software Cracks & Keygens",
    "Compromised MikroTik Router Exploitation"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server",
    "MikroTik RouterOS"
  ],
  "capabilities": [
    "Bitcoin Blockchain OP_RETURN C2 Discovery",
    "Bring Your Own Vulnerable Driver (BYOVD) Rootkit",
    "Monero Cryptocurrency Mining",
    "Browser Credential & Cookie Theft",
    "Residential SOCKS5 Proxy Relaying",
    "Router Exploitation & Traffic Interception"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Go / C++)",
      "Signed Kernel Driver (.sys)",
      "Monero Miner Binary"
    ],
    "network_signatures": [
      "Electrum protocol and public blockchain API queries parsing Bitcoin transactions for encoded C2 domain strings",
      "High-volume encrypted Stratum mining traffic and outbound SOCKS5 proxy relaying on non-standard ports"
    ],
    "evasion_techniques": [
      "Loading legitimately signed third-party drivers (such as signed WinRing0 or Process Hacker drivers) to terminate antivirus processes from kernel space",
      "Decentralized blockchain-based C2 infrastructure immune to registrar domain seizure"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6",
      "08b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\GluptebaService",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Glupteba"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\glupteba.exe",
      "%AppData%\\Glupteba\\miner.exe",
      "%Temp%\\driver.sys"
    ]
  },
  "defensive_measures": [
    "Enable the Microsoft Vulnerable Driver Blocklist in Windows Defender Application Control (WDAC) to prevent BYOVD exploitation",
    "Monitor outbound network connections to public Bitcoin blockchain explorers and mining pools",
    "Patch and secure boundary networking devices, specifically MikroTik routers running RouterOS"
  ],
  "sources": [
    {
      "name": "Google Threat Analysis Group (TAG) - Disrupting the Glupteba Botnet",
      "url": "https://blog.google/threat-analysis-group"
    },
    {
      "name": "CISA Advisory - Multi-Platform Botnet Threats: Glupteba",
      "url": "https://www.cisa.gov"
    },
    {
      "name": "Trend Micro Research - The Glupteba Botnet: An In-Depth Look at Blockchain-Enabled Malware",
      "url": "https://www.trendmicro.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Glupteba v1",
      "Glupteba v2 (Blockchain Enabled)",
      "Trojan:Win32/Glupteba.gen"
    ]
  },
  "motivation": "Cryptomining, Proxy Relaying, Credential Theft & Resilient Botnet Monetization",
  "sample_hashes": []
}