GRIDTIDE Config File Staging in Sensitive Linux Directories

Ethan Andrews@eandrews

•updated Feb 25, 2026•2•0•47

Detects the creation of configuration files (.cfg) in sensitive or temporary Linux directories. This behavior is associated with the GRIDTIDE backdoor, which stages a configuration file containing a key to decrypt its C2 settings.