Topic

Linux malware

Malicious software built to run on Linux servers and devices, including backdoors, web shells and botnet agents.

Current stories

securityConfirmed4 publishers

Linux implants on Korean and Taiwanese edge appliances run from memory after erasing their files

Rapid7 tracked Linux implants on South Korean and Taiwanese edge appliances that erase their files ten seconds after launch but keep running. File scans miss them, so defenders have to hunt processes with no image on disk.

Publishers:blog.rapid7.com infosecurity-magazine.com scworld.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 29%
Operator: Operator 66%
Investor: Investor 5%

Reality

Evidence64
Adoption: Not scored
Hype gap+12
Incentives35
Confidence62

securityConfirmed3 publishers

ClingSTUN backdoor turns vulnerable Linux devices into proxies that check in through public STUN servers

FortiGuard Labs says the ClingSTUN Linux backdoor exploits two dozen flaws in a dozen vendors' gear and carries seven more to spread itself. Exploitation is indiscriminate, so any reachable vulnerable device on those lists, Ivanti's included, can join its proxy pool.

Publishers:infosecurity-magazine.com securityaffairs.com securityweek.com

Perspective Coverage

3 publishers

Builder: Builder 33%
Operator: Operator 57%
Investor: Investor 10%

Reality

Evidence60
Adoption: Not scored
Hype gap+10
Incentives40
Confidence58

securityConfirmed5 publishers

Evooo1Bot turns edge gear into rentable proxy stock, and the tell is outbound

Fortinet says the Mirai-derived botnet bolts a SOCKS5 relay onto compromised routers, cameras and Confluence hosts. Sellable proxy capacity changes what you hunt for.

Publishers:bleepingcomputer.com infosecurity-magazine.com securityaffairs.com thehackernews.com therecord.media

Perspective Coverage

5 publishers

Builder: Builder 25%
Operator: Operator 63%
Investor: Investor 12%

Reality

Evidence60
Adoption: Not scored
Hype gap+10
Incentives30
Confidence65

securityConfirmed5 publishers

DPRK operators compiled their backdoor into the victim's own HAProxy build

Rapid7 says the ted backdoor is built into the victim's existing HAProxy 2.8.12 and hooks its filter API, so the load balancer keeps balancing normally while it logs cookies and injects scripts for selected clients.

Publishers:blog.rapid7.com scworld.com securityaffairs.com securityweek.com thehackernews.com

Perspective Coverage

5 publishers

Builder: Builder 42%
Operator: Operator 53%
Investor: Investor 5%

Reality

Evidence70
Adoption10
Hype gap+20
Incentives35
Confidence66

securityConfirmed7 publishers

Fully patched Magento stores are being backdoored four days ahead of Adobe's next security release

Sansec reproduced an unauthenticated code-execution chain on clean 2.4.7, 2.4.8 and 2.4.9 installs, and the first victim it saw was already on Adobe's newest patch level for its release line.

Publishers:bleepingcomputer.com sansec.io securityaffairs.com securityweek.com tenable.com thecyberexpress.com thehackernews.com

Perspective Coverage

7 publishers

Builder: Builder 29%
Operator: Operator 63%
Investor: Investor 8%

Reality

Evidence78
Adoption55
Hype gap+15
Incentives55
Confidence75