Linux version of Winnti malware found

Image credit: Pixabay

Security researchers from Alphabet's cybersecurity firm Chronicle have discovered a Linux version of the Winnti malware while investigating a recent cyberattack carried out against the pharmaceutical giant Bayer.

According to the researchers, the code contained within the Linux variant resembles the Winnti 2.0 Windows version which has been used by Chinese cybercriminals for the past decade to launch attacks on systems worldwide.

It is believed by security experts that several Advanced Persistent Threat (APT) groups operate under the Winnti umbrella including Winnti, Wicked Panda, ShadowPad, DeputDog, APT17, PassCV and others.

All of these groups have used similar strategies and techniques in the past and have even shared parts of the same hacking infrastructure.

Linux variant of Winnti

According to Chronicle, the Linux version of Winnti is designed to work as a backdoor on infected hosts which gives hackers the ability to access the compromised system.

The researchers first discovered the existence of the Linux version while attempting to look for Winnti malware samples on the company's VirusTotal platform.

After analyzing the Linux variant, Chronicle discovered that it dated back to 2015 and contained a backdoor Trojan (libxselinux) and a library ( which is used to hide the malware from detection.

In their blog post, the researchers provided further details on how the Linux version of Winnti functions, saying:

“As with other versions of Winnti, the core component of the malware doesn’t natively provide the operators with distinct functionality. This component is primarily designed to handle communications and the deployment of modules directly from the command-and-control servers. During our analysis, we were unable to recover any active plugins. However, prior reporting suggests that the operators commonly deploy plugins for remote command execution, file exfiltration, and socks5 proxying on the infected host. We expect similar functionality to be leveraged via additional modules for Linux.”

Via The Inquirer

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.