Linux malware FontOnLake is used in targeted attacks

ESET specialists talked about the FontOnLake malware, which combines backdoor and rootkit components. The malware is known to be used in targeted attacks against organizations in Southeast Asia.

Experts write that the first file related to this malware family appeared on VirusTotal back in May last year, and other samples were uploaded during the year. Based on where these files were downloaded from, the researchers concluded that FontOnLake was primarily used in Southeast Asia. At the time of this writing, all the malware’s control servers had already been disabled. But the researchers note that, as a rule, during targeted attacks, hackers act in this way: the work of the infrastructure stops as soon as their goals are achieved.

It is known that FontOnLake is distributed through trojanized applications, but researchers do not know how the attackers forced their victims to download modified binaries. Among the utilities that the attacker modified to deliver FontOnLake were cat, kill, sftp, and shd.

According to the researchers, the trojanized utilities were probably modified at the source code level, that is, the attackers compiled them and replaced the original.

All trojanized files are standard Linux utilities and are needed to maintain their presence in the system, because they are usually launched at system startup.the experts write.

भी, the modified binaries provided loading of additional payloads, collecting information and performing other malicious actions. The fact is that FontOnLake has several modules that interact with each other and allow hackers to steal confidential data, effectively hiding their presence in the system.

FontOnLake

The experts also discovered three custom backdoors written in C ++ and related to FontOnLake. They provide malware operators with remote access to the infected system. A common feature for all backdoors is to pass the collected sshd credentials and bash command history to the command and control server.

The presence of FontOnLake in a compromised system is also masked by a rootkit, which is also responsible for updating and delivering backup backdoors. All rootkit samples studied by ESET targeted kernel versions 2.6.32-696.el6.x86_64 and 3.10.0-229.el7.X86_64.

ESET notes that FontOnLake is most likely the same malware previously analyzed by Tencent Security Response Center experts. It also seems that this malware has already been detected by Avast और Lacework specialists, in whose reports it appeared as the HCRootkit और Sutersu rootkit.

Let me remind you that we also wrote that Hackers create Cobalt Strike Beacon for Linux.

हेल्गा स्मिथ

मुझे हमेशा से कंप्यूटर विज्ञान में रुचि थी, विशेष रूप से डेटा सुरक्षा और विषय, जिसे आजकल कहा जाता है "डेटा विज्ञान", मेरी शुरुआती किशोरावस्था से ही. मुख्य संपादक के रूप में वायरस रिमूवल टीम में आने से पहले, मैंने कई कंपनियों में साइबर सुरक्षा विशेषज्ञ के रूप में काम किया, जिसमें अमेज़न का एक ठेकेदार भी शामिल है. एक और अनुभव: मुझे आर्डेन और रीडिंग विश्वविद्यालयों में पढ़ाना है.

उत्तर छोड़ दें

यह साइट स्पैम को कम करने के लिए Akismet का उपयोग करती है. जानें कि आपका टिप्पणी डेटा कैसे संसाधित किया जाता है.

शीर्ष पर वापस जाएँ बटन