Warning of new dangerous malware attack campaign targeting Linux

Experts from security firm ESET have recently discovered a new Linux backdoor called WolfsBane, which is being used by the China-linked Gelsemium APT hacker group to carry out malicious operations. This is also the first documented case of Gelsemium using Linux malware. The backdoor is designed to steal sensitive data, including system information, user credentials, and specific files and folders.

WolfsBane is actually the Linux version of Gelsevirine, a Windows backdoor that Gelsemium has been using since 2014. The backdoor is delivered using a dropper that masquerades as a 'standard auth' command scheduler. Once executed, the dropper installs the WolfsBane launcher and backdoor on the target system. The launcher is disguised as a KDE desktop component, while the backdoor is hidden as a system service.

The WolfsBane backdoor communicates with the command and control (C&C) server via a custom network protocol. It can run commands, download files, and upload them to the C&C server. WolfsBane can also hide its presence on the system by modifying the system's configuration files.

Warning of new dangerous malware attack campaign targeting Linux Picture 1

In addition to WolfsBane, ESET researchers have identified another Linux backdoor, called FireWood, that is related to the Project Wood malware. Gelsemium previously used Project Wood as a Windows backdoor. FireWood is the Linux version of Project Wood and is also designed to steal sensitive information from the target system.

Researchers believe the shift to Linux malware is due to improvements in Windows endpoint security. As a result, threat actors are exploring new attack vectors, increasingly focusing on exploiting vulnerabilities in internet-connected systems, most of which run on Linux.

The discovery of WolfsBane and FireWood is a reminder that internet-connected Linux systems are now fundamentally vulnerable. Organizations and businesses must understand the dangers posed by Linux malware and take the necessary security measures to protect their systems. This includes using strong passwords, keeping software up to date, and being cautious when downloading and running specific files.

Marvin Fry

Update 09 December 2024

You should read it

May be interested

Detects new Xcode malware targeting iOS developers
international cybersecurity experts have broadcast an urgent message about a malicious xcode project called xcodespy. the malware is currently targeting ios software developers in a supply-chain attack.
Masslogger - malicious code possesses the ability to steal all the login information of Chrome, Edge Outlook of the target
masslogger - a notorious trojan that specializes in stealing credentials targeting windows systems that officially have a dangerous 're-export'.
Warning: The malware campaign hides the shadow of gift emails from Amazon
traditionally, the holidays and year-end shopping holidays are always a golden opportunity for bad actors to launch a series of malicious campaigns on cyberspace to gain illegal profits from those who are fickle and gullible.
Ransomware is being used as bait in data destruction attacks targeting Ukraine
international security researchers have issued a warning about a new type of data erasure malware that is currently being deployed in destructive attacks targeting ukraine's network infrastructure.
Appears new malware HiatusRAT targeting enterprise routers
a new malware campaign, called hiatus, is targeting small business routers to steal data and track victims.
Detecting APT attack campaign on important national infrastructure on Tet holiday
the main purpose of hackers is to gain user control, then through it to attack internal computer systems to steal important information.
GoldBrute botnet campaign is trying to hack 1.5 million RDP servers worldwide
new security researchers discover an ongoing sophisticated botnet campaign, using brute-force methods targeting more than 1.5 million publicly accessible windows rdp servers on the internet.
What is Safe Malware? Why is it so dangerous?
remote access trojan (rat) is a type of malware that allows hackers to monitor and control the victim's computer or network.
Malware WSL appeared with the ability to steal browser authentication cookies
windows subsystem for linux (wsl) has not been released for a long time, but there is already malicious code targeting this system.
How to Protect Yourself from the Latest WordPress Malware Attack
as one of the most popular website building tools in the world, wordpress is once again a target for malware.

Warning of new dangerous malware attack campaign targeting Linux

You should read it

May be interested

Tech info