Beware - a brand new malware family is infecting Linux systems
Malware can exfil data and give remote access to its operators
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
There’s a newmalwarefamily in town - and one that attacksLinux systemsby concealing itself in legitimate binaries to deliver several backdoor and rootkits.
Dubbed FontOnLake, bycybersecurityresearchers atESET, samples of the malware date as far back as May 2020.
According to the researchers, the malware makes use of several carefully crafted modules that not just collect credentials, but also giveremote accessto the threat actors.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
“The sneaky nature of FontOnLake’s tools in combination with advanced design and low prevalence suggest that they are used in targeted attacks,”believesVladislav Hrčka, malware analyst and reverse engineer at ESET.
Trojanized utilities
Hrčka notes that all the malware disguises itself inside trojanized versions of standardLinuxutilities, includingcat,kill, andsshd. In fact, one of the samples the researchers analyzed was created specifically forCentOSand Debian.
However, the exact mechanism employed by the threat actors to replace the original utilities with the malicious ones remains a mystery.
Analyzing the malware, the researchers note that the samples contained three custom backdoors written in C++, which gave remote access to the infected machines to the operators of the malware.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The location of the Command and Control (C2) server and the countries from which the samples were uploaded indicate that the attackers were after targets based in Southeast Asia.
“Following our discovery while finalizing our white paper on this topic, vendors such asTencent Security Response Center,AvastandLacework Labspublished their research on what appears to be the same malware,” notes Hrčka, adding that ESET’s products can flag all the components of the malware.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Don’t search for information on cats at work — you could be at risk of being hacked
This dangerous new malware is hitting Windows devices by hiding in games
Undermining your privacy? Session says no and leaves Australia
