Skip to main content

This sneaky Linux malware has been operating under the radar for years

Skull and Bones
(Image credit: Pixabay)
Audio player loading…

Security researchers have recently flagged a backdoor malware (opens in new tab) that targets 64-bit Linux installations (opens in new tab). However the researchers report that the malware has evaded detection for at least three years. 

Analysis of the backdoor, named RotaJakiro by researchers at Qihoo 360 (opens in new tab)'s Network Security Research Lab (360 Netlab), revealed that it enables attackers to harvest and exfiltrate sensitive information from compromised devices. 

BleepingComputer reports that the malware isn’t picked up by VirusTotal's anti-malware engines, despite the fact that a sample was first uploaded to its database in 2018.

TechRadar needs yo...

We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.

>> Click here to start the survey in a new window (opens in new tab)<<

The 360 Netlab researchers say that the malware uses the ROTATE encryption (opens in new tab) algorithm and has different profiles that it employs depending on whether its executing on a root or a non-root account. 

Once it’s made itself home, it establishes communication with the command and control (C&C) server and awaits instructions.

Stealthy operator

The researchers note that RotaJakiro takes several steps to ensure it stays under the radar, including compressing and encrypting its communication channels using ZLIB, AES, XOR, ROTATE algorithms.

Breaking down the malware further reveals that RotaJakiro has several functional similarities with the Torii Botnet (opens in new tab), which was exposed by security researchers at Avast (opens in new tab) back in 2018. 

More worryingly however, the 360 Netlab researchers are clueless as to the true intent of the threat actors behind the malware. 

“RotaJakiro supports a total of 12 functions, three of which are related to the execution of specific Plugins. Unfortunately, we have no visibility to the plugins, and therefore do not know its true purpose,” admit the researchers. 

They believe their analysis is just the “tip of the iceberg” and the malware will remain a threat until they uncover its true intentions and how it managed to spread. 

Via BleepingComputer (opens in new tab)

Mayank Sharma
Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.