Linux malware FontOnLake is used in targeted attacks

ESET specialists talked about the FontOnLake malware, which combines backdoor and rootkit components. The malware is known to be used in targeted attacks against organizations in Southeast Asia.

Experts write that the first file related to this malware family appeared on VirusTotal back in May last year, and other samples were uploaded during the year. Based on where these files were downloaded from, the researchers concluded that FontOnLake was primarily used in Southeast Asia. At the time of this writing, all the malware’s control servers had already been disabled. But the researchers note that, as a rule, during targeted attacks, hackers act in this way: the work of the infrastructure stops as soon as their goals are achieved.

It is known that FontOnLake is distributed through trojanized applications, but researchers do not know how the attackers forced their victims to download modified binaries. Among the utilities that the attacker modified to deliver FontOnLake were cat, kill, sftp, and shd.

According to the researchers, the trojanized utilities were probably modified at the source code level, that is, the attackers compiled them and replaced the original.

All trojanized files are standard Linux utilities and are needed to maintain their presence in the system, because they are usually launched at system startup.the experts write.

Juga, the modified binaries provided loading of additional payloads, collecting information and performing other malicious actions. The fact is that FontOnLake has several modules that interact with each other and allow hackers to steal confidential data, effectively hiding their presence in the system.

FontOnLake

The experts also discovered three custom backdoors written in C ++ and related to FontOnLake. They provide malware operators with remote access to the infected system. A common feature for all backdoors is to pass the collected sshd credentials and bash command history to the command and control server.

The presence of FontOnLake in a compromised system is also masked by a rootkit, which is also responsible for updating and delivering backup backdoors. All rootkit samples studied by ESET targeted kernel versions 2.6.32-696.el6.x86_64 and 3.10.0-229.el7.X86_64.

ESET notes that FontOnLake is most likely the same malware previously analyzed by Tencent Security Response Center experts. It also seems that this malware has already been detected by Avast Dan Lacework specialists, in whose reports it appeared as the HCRootkit Dan Sutersu rootkit.

Izinkan saya mengingatkan Anda bahwa kami juga menulis itu Hackers create Cobalt Strike Beacon for Linux.

Helga Smith

Saya selalu tertarik pada ilmu komputer, terutama keamanan data dan tema, yang disebut saat ini "ilmu data", sejak remaja awal saya. Sebelum masuk ke tim Penghapusan Virus sebagai Pemimpin Redaksi, Saya bekerja sebagai pakar keamanan siber di beberapa perusahaan, termasuk salah satu kontraktor Amazon. Pengalaman lain: Yang saya dapatkan adalah mengajar di universitas Arden dan Reading.

Tinggalkan Balasan

Situs ini menggunakan Akismet untuk mengurangi spam. Pelajari bagaimana data komentar Anda diproses.

Tombol kembali ke atas