1. Home
  2. Software
  3. DEEPROOT

DEEPROOT

DEEPROOT is a Linux backdoor written in Golang.[1] DEEPROOT is able to execute commands via a shell, enumerate systems, delete or download files, and exfiltrate data.[1] DEEPROOT was first observed in 2025.[1] DEEPROOT has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9063
ⓘ
Type: MALWARE
ⓘ
Platforms: Linux
Version: 1.0
Created: 01 October 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 .004 Command and Scripting Interpreter: Unix Shell

DEEPROOT can execute shell commands.[1]
Enterprise T1132 .001 Data Encoding: Standard Encoding

DEEPROOT has received hex-encoded payloads from the C2 server where the values are separated by "-===-".[1]
Enterprise T1678 Delay Execution

DEEPROOT has a delay function that is capable of sleeping before making subsequent requests.[1]
Enterprise T1041 Exfiltration Over C2 Channel

DEEPROOT has the ability to upload files to C2.[1]
Enterprise T1008 Fallback Channels

DEEPROOT has communicated with multiple C2 servers as a means of redundancy if one fails.[1]
Enterprise T1083 File and Directory Discovery

DEEPROOT can gather file and directory details.[1]
Enterprise T1070 .004 Indicator Removal: File Deletion

DEEPROOT has the ability to delete files.[1]
Enterprise T1105 Ingress Tool Transfer

DEEPROOT has the ability to download files from C2.[1]
Enterprise T1082 System Information Discovery

DEEPROOT has gathered the victim hostname.[1]
Enterprise T1033 System Owner/User Discovery

DEEPROOT can obtain the victim’s username.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

DEEPROOT has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.