Linux malware FontOnLake is used in targeted attacks

ESET specialists talked about the FontOnLake malware, which combines backdoor and rootkit components. The malware is known to be used in targeted attacks against organizations in Southeast Asia.

Experts write that the first file related to this malware family appeared on VirusTotal back in May last year, and other samples were uploaded during the year. Based on where these files were downloaded from, the researchers concluded that FontOnLake was primarily used in Southeast Asia. At the time of this writing, all the malware’s control servers had already been disabled. But the researchers note that, as a rule, during targeted attacks, hackers act in this way: the work of the infrastructure stops as soon as their goals are achieved.

It is known that FontOnLake is distributed through trojanized applications, but researchers do not know how the attackers forced their victims to download modified binaries. Among the utilities that the attacker modified to deliver FontOnLake were cat, kill, sftp, and shd.

According to the researchers, the trojanized utilities were probably modified at the source code level, mao, the attackers compiled them and replaced the original.

All trojanized files are standard Linux utilities and are needed to maintain their presence in the system, because they are usually launched at system startup.the experts write.

Usab, the modified binaries provided loading of additional payloads, collecting information and performing other malicious actions. The fact is that FontOnLake has several modules that interact with each other and allow hackers to steal confidential data, effectively hiding their presence in the system.

FontOnLake

The experts also discovered three custom backdoors written in C ++ and related to FontOnLake. They provide malware operators with remote access to the infected system. A common feature for all backdoors is to pass the collected sshd credentials and bash command history to the command and control server.

The presence of FontOnLake in a compromised system is also masked by a rootkit, which is also responsible for updating and delivering backup backdoors. All rootkit samples studied by ESET targeted kernel versions 2.6.32-696.el6.x86_64 and 3.10.0-229.el7.X86_64.

ESET notes that FontOnLake is most likely the same malware previously analyzed by Tencent Security Response Center experts. It also seems that this malware has already been detected by Avast ug Lacework specialists, in whose reports it appeared as the HCRootkit ug Sutersu rootkit.

Tugoti ko nga pahinumdoman ka nga kami usab ang nagsulat niana Hackers create Cobalt Strike Beacon for Linux.

Helga Smith

Kanunay kong interesado sa siyensya sa kompyuter, ilabi na ang seguridad sa datos ug ang tema, nga gitawag karon "siyensya sa datos", sukad pa sa akong pagkabatan-on. Sa wala pa mosulod sa Virus Removal team isip Editor-in-chief, Nagtrabaho ko isip eksperto sa cybersecurity sa daghang kompanya, lakip ang usa sa mga kontraktor sa Amazon. Laing kasinatian: Naa koy pagtudlo sa mga unibersidad sa Arden ug Reading.

Pagbilin ug Tubag

Kini nga site naggamit sa Akismet aron makunhuran ang spam. Hibal-i kung giunsa ang pagproseso sa data sa imong komento.

Balik sa ibabaw nga buton