malware

RotaJakiro

S1078 · ATT&CK v19.2

Platforms

Linux

Tracked actors

Description

[RotaJakiro](https://attack.mitre.org/software/S1078) is a 64-bit Linux backdoor used by [APT32](https://attack.mitre.org/groups/G0050). First seen in 2018, it uses a plugin architecture to extend capabilities. [RotaJakiro](https://attack.mitre.org/software/S1078) can determine it's permission level and execute according to access type (`root` or `user`).(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: netlab360 rotajakiro vs oceanlotus)

Actors that use this

0 tracked actors

No tracked actor uses this yet

Not linked to any of our tracked MENA actors in actor_software — still browsable via the ATT&CK dictionary above.