Dubbed RedXOR because of its peculiar network data encoding scheme based on XOR, news of the previously undocumented backdoor was shared by a couple of researchers at Intezer. Furthermore, based on its Tactics, Techniques, and Procedures (TTPs), Intezer believes RedXOR is the work of high-profile Chinese threat actors.
“2020 set a record for new Linux (opens in new tab) malware families. New malware families targeting Linux systems (opens in new tab) are being discovered on a regular basis. Backdoors attributed to advanced threat actors are disclosed less frequently,” note the researchers while sharing details about RedXOR.
- Check our list of the best firewall apps and services (opens in new tab)
- These are the best password recovery (opens in new tab) services right now
- Protect your devices with these best antivirus software (opens in new tab)
Linux systems are under constant attack since it powers a majority of the public cloud workload, the researchers observe. This puts Linux on the crosshairs of all kinds of threat groups, and RedXOR is just part of this trend.
"Some of the most prominent nation-state actors are incorporating offensive Linux capabilities into their arsenal and it's expected that both the number and sophistication of such attacks will increase over time," says a 2020 report by Intezer.
While investigating the backdoor, the researchers noticed that its Command and Control (C&C) server came online now and then, which led the researchers to conclude that the backdoor is still being actively exploited.
According to the researchers, samples of the malware were uploaded from Indonesia and Taiwan, which are some of the usual targets for Chinese threat actors. They also noticed similarities between RedXOR and earlier malware by the known Chinese state-sponsored Winnti threat group.
During their analysis of the samples, the researchers discovered that they were compiled with a legacy GCC compiler on an old release of Red Hat Enterprise Linux, which suggests that RedXOR is designed to target legacy Linux systems.
- Subscribe to Linux Format magazine (opens in new tab) for more Linux and open source goodness