Back Eset

Linux and BSD Web Servers At Risk Of Sophisticated Mumblehard Infection, Says ESET

Eset • July 15, 2026

ESET® , a global pioneer in proactive protection for more than two decades, has today published its in-depth technical research paper, entitled ‘ Unboxing Linux/Mumblehard - Muttering Spam for your Servers ’. Linux/Mumblehard targets servers running Linux and BSD systems. The primary purpose of this malware is to use infected systems for spamming bots.

ESET researchers say the malware is made up of two different components. Exploiting vulnerabilities in Joomla and Wordpress, the first component is a generic backdoor that requests commands from its Command and Control server. The second component is a full¬-featured spammer daemon that is launched via a command received by the backdoor. Mumblehard is also distributed via ‘pirated’ copies of a Linux and BSD program known as DirectMailer, software sold on the Yellsoft website for $240.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ESET Uncovers Long-Standing Linux/Mumblehard Malware Targeting Web Servers ESET researchers have identified a sophisticated family of Linux malware named Linux/Mumblehard, which has been active for over five years. This malware primarily targets Linux and BSD web servers, utilizing a backdoor and a spamming daemon written in Perl. The backdoor exploits vulnerabilities in popular content management systems like Joomla and WordPress, allowing it to receive commands from its Command and Control (C&C) server. The malware is distributed through pirated copies of a program called DirectMailer, sold by Yellsoft. During monitoring, over 8,500 unique IP addresses were observed exhibiting Mumblehard behavior, with more than 3,000 machines affected in early April 2026. The malware's main purpose is to send spam messages while hiding behind the legitimate IP addresses of infected machines. Victims are advised to check for unsolicited cronjob entries that may indicate infection. A detailed white paper on Mumblehard is available for download. 2 sources 55

Extracted Entities

Linux and BSD Web Servers At Risk Of Sophisticated Mumblehard Infection, Says ESET

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (5)