malware

DEEPROOT

S9063 · ATT&CK v20.0

Platforms

Linux

Tracked actors

Description

[DEEPROOT](https://attack.mitre.org/software/S9063) is a Linux backdoor written in Golang.(Citation: Mandiant_UNC1549_Nov2025) [DEEPROOT](https://attack.mitre.org/software/S9063) is able to execute commands via a shell, enumerate systems, delete or download files, and exfiltrate data.(Citation: Mandiant_UNC1549_Nov2025) [DEEPROOT](https://attack.mitre.org/software/S9063) was first observed in 2025.(Citation: Mandiant_UNC1549_Nov2025) [DEEPROOT](https://attack.mitre.org/software/S9063) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025)

Actors that use this

0 tracked actors

No tracked actor uses this yet

Not linked to any of our tracked MENA actors in actor_software — still browsable via the ATT&CK dictionary above.