Security researchers have found a new sophisticated backdoor malware which they believe is being exploited to target Linux endpoints and servers.
Dubbed RedXOR because of its peculiar network data encoding scheme based on XOR, news of the previously undocumented backdoor was shared by a couple of researchers at Intezer. Furthermore, based on its Tactics, Techniques, and Procedures (TTPs), Intezer believes RedXOR is the work of high-profile Chinese threat actors.
“2020 set a record for new Linux malware families. New malware families targeting Linux systems are being discovered on a regular basis. Backdoors attributed to advanced threat actors are disclosed less frequently,” note the researchers while sharing details about RedXOR.
- Check our list of the best firewall apps and services
- These are the best password recovery services right now
- Protect your devices with these best antivirus software
Active operation
Linux systems are under constant attack since it powers a majority of the public cloud workload, the researchers observe. This puts Linux on the crosshairs of all kinds of threat groups, and RedXOR is just part of this trend.
"Some of the most prominent nation-state actors are incorporating offensive Linux capabilities into their arsenal and it's expected that both the number and sophistication of such attacks will increase over time," says a 2020 report by Intezer.
While investigating the backdoor, the researchers noticed that its Command and Control (C&C) server came online now and then, which led the researchers to conclude that the backdoor is still being actively exploited.
According to the researchers, samples of the malware were uploaded from Indonesia and Taiwan, which are some of the usual targets for Chinese threat actors. They also noticed similarities between RedXOR and earlier malware by the known Chinese state-sponsored Winnti threat group.
During their analysis of the samples, the researchers discovered that they were compiled with a legacy GCC compiler on an old release of Red Hat Enterprise Linux, which suggests that RedXOR is designed to target legacy Linux systems.
- Subscribe to Linux Format magazine for more Linux and open source goodness
Via: BleepingComputer
