DEEPROOT is a Linux backdoor written in Golang. DEEPROOT is able to execute commands via a shell, enumerate systems, delete or download files, and exfiltrate data. DEEPROOT was first observed in 2025. DEEPROOT has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.
Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.
Upgrade to Premium