DEEPROOT is a Linux backdoor written in Golang. DEEPROOT is able to execute commands via a shell, enumerate systems, delete or download files, and exfiltrate data. DEEPROOT was first observed in 2025. DEEPROOT has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.