This sneaky Linux malware has been operating under the radar for years

Skull and Bones
(Image credit: Pixabay)

Security researchers have recently flagged a backdoor malware that targets 64-bit Linux installations. However the researchers report that the malware has evaded detection for at least three years. 

Analysis of the backdoor, named RotaJakiro by researchers at Qihoo 360's Network Security Research Lab (360 Netlab), revealed that it enables attackers to harvest and exfiltrate sensitive information from compromised devices. 

BleepingComputer reports that the malware isn’t picked up by VirusTotal's anti-malware engines, despite the fact that a sample was first uploaded to its database in 2018.

TechRadar needs yo...

We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.

>> <a href="https://project.tolunastart.com/s/r9AXk4" data-link-merchant="project.tolunastart.com"" target="_blank">Click here to start the survey in a new window<<

The 360 Netlab researchers say that the malware uses the ROTATE encryption algorithm and has different profiles that it employs depending on whether its executing on a root or a non-root account. 

Once it’s made itself home, it establishes communication with the command and control (C&C) server and awaits instructions.

Stealthy operator

The researchers note that RotaJakiro takes several steps to ensure it stays under the radar, including compressing and encrypting its communication channels using ZLIB, AES, XOR, ROTATE algorithms.

Breaking down the malware further reveals that RotaJakiro has several functional similarities with the Torii Botnet, which was exposed by security researchers at Avast back in 2018. 

More worryingly however, the 360 Netlab researchers are clueless as to the true intent of the threat actors behind the malware. 

“RotaJakiro supports a total of 12 functions, three of which are related to the execution of specific Plugins. Unfortunately, we have no visibility to the plugins, and therefore do not know its true purpose,” admit the researchers. 

They believe their analysis is just the “tip of the iceberg” and the malware will remain a threat until they uncover its true intentions and how it managed to spread. 

Via BleepingComputer

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.