SecuriTricks

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Two npm packages, @rspack/core and @rspack/cli, were compromised in a supply chain attack, allowing the publication of malicious versions containing cryptocurrency mining malware. The attack targeted specific countries and aimed to execute XMRig cryptocurrency miner on Linux hosts. The malicious ve…

linux

xmrig

Published: December 20, 2024

Downloadable IOCs: 1

cShell DDoS Bot Attack Case Targeting Linux SSH Server (screen and hping3)

A new DDoS malware strain named cShell is targeting poorly managed Linux servers through SSH services. The threat actor uses brute force attacks to gain initial access, then installs the cShell bot developed in Go language. cShell exploits Linux tools 'screen' and 'hping3' to perform various DDoS a…

Published: December 20, 2024

Downloadable IOCs: 1

A Deep Dive into TeamTNT and Spinning YARN

TeamTNT is conducting a crypto mining campaign called Spinning YARN, targeting Docker, Redis, YARN, and Confluence. The attack involves server-side scripting vulnerabilities, obfuscated code, and malware deployment. The malware assesses the environment, disables cloud security, establishes persiste…

Published: December 18, 2024

Downloadable IOCs: 35

Unpacking the Diicot Malware Targeting Linux Environments

A new malware campaign attributed to the Romanian-speaking Diicot threat group has been discovered targeting Linux systems. The campaign shows significant advancements compared to previous iterations, including modified UPX headers with corrupted checksums, advanced payload staging, and environment…

Published: December 17, 2024

Downloadable IOCs: 36

First UEFI bootkit malware for Linux discovered

A groundbreaking discovery has been made in the realm of cybersecurity: the first UEFI bootkit specifically targeting Linux systems. Named 'Bootkitty,' this proof-of-concept malware marks a significant evolution in stealthy and hard-to-remove bootkit threats. Although currently limited to certain U…

Published: November 27, 2024

Downloadable IOCs: 0

Unveiling WolfsBane: Linux counterpart to Gelsevirine

ESET researchers have discovered previously unknown Linux backdoors attributed to the China-aligned Gelsemium APT group. The main backdoor, named WolfsBane, is the Linux equivalent of Gelsemium's Gelsevirine backdoor for Windows. Another backdoor, FireWood, is connected to the group's Project Wood …

Published: November 22, 2024

Downloadable IOCs: 41

Helldown Ransomware: an overview of this emerging threat

Helldown is a new and highly active ransomware group that has claimed 31 victims in three months. It employs custom ransomware for Windows and Linux systems, engages in double extortion, and exploits vulnerabilities in Zyxel firewalls for initial access. The group exfiltrates large volumes of data,…

Published: November 20, 2024

Downloadable IOCs: 0

Akira ransomware continues to evolve

Akira ransomware has established itself as a prominent threat, constantly evolving its tactics. Initially employing double-extortion, it shifted focus to data exfiltration in early 2024. The group developed a Rust variant of their ESXi encryptor, moving away from C++. Recently, Akira has returned t…

vulnerability exploitation

Published: October 22, 2024

Downloadable IOCs: 37

THREAT ANALYSIS: Beast Ransomware

The Beast Ransomware group, active since 2022, offers a Ransomware-as-a-Service (RaaS) platform with constant updates. It supports Windows, Linux, and ESXi systems, providing affiliates with customizable binary options. Beast employs advanced encryption methods, including Elliptic-curve and ChaCha2…

Published: October 19, 2024

Downloadable IOCs: 0

New Linux Malware Targeting ATMs for Financial Fraud

A recent analysis reveals a new variant of the FASTCash malware, designed to compromise financial networks by manipulating payment transactions. Developed by threat actors potentially linked to North Korean hacking groups, this Linux version specifically targets Ubuntu 20.04 systems in ATMs. It int…

Published: October 17, 2024

Downloadable IOCs: 12

FASTCash for Linux

A newly identified variant of FASTCash "payment switch" malware specifically targets the Linux operating system, as well as Microsoft Windows, according to CISA and the Department of Homeland Security (DHS).

Published: October 15, 2024

Downloadable IOCs: 12

Lynx Ransomware: A Rebranding of INC Ransomware

Lynx ransomware, discovered in July 2024, is a successor to INC ransomware targeting organizations in retail, real estate, architecture, and financial services in the U.S. and UK. It shares significant source code with INC and operates as a ransomware-as-a-service model. Lynx employs double extorti…

Published: October 14, 2024

Downloadable IOCs: 44

From Perfctl to InfoStealer

A new stealthy Linux malware called perfctl has been analyzed. The malware runs two processes: perfctl and a disguised process mimicking known Linux processes. It uses Tor for external communications and local sockets for inter-process communication. After 30 minutes, the attacker drops scripts to …

Published: October 9, 2024

Downloadable IOCs: 3

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

A sophisticated Linux malware named 'perfctl' has been actively targeting millions of servers worldwide for the past 3-4 years. It exploits over 20,000 types of misconfigurations to compromise Linux systems. The malware employs advanced evasion techniques, including rootkits, process masquerading, …

Published: October 4, 2024

Downloadable IOCs: 9

OSINT Investigation: Hunting Malicious Infrastructure Linked to Transparent Tribe

This investigation tracked infrastructure linked to the APT group Transparent Tribe, identifying 15 malicious hosts on DigitalOcean serving as command-and-control servers for the Mythic exploitation framework. The group employs Linux desktop entry files as an attack vector, targeting individuals in…

Published: September 30, 2024

Downloadable IOCs: 19

Hadooken Malware Targets Weblogic Applications

Aqua Nautilus researchers identified a Linux malware, named Hadooken, targeting Oracle WebLogic servers. Upon gaining initial access through an exploited weak password, Hadooken deploys a cryptominer and the Tsunami malware. The report details the attack flow, techniques employed by the threat acto…

Published: September 13, 2024

Downloadable IOCs: 4

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401

A critical security flaw in the Open Geospatial Consortium (OGC) GeoServer server has been exploited by cyber-attackers to gain control of vulnerable systems, according to FortiGuard Labs.

Published: September 10, 2024

Downloadable IOCs: 75

Unveiling sedexp: A Stealthy Linux Malware Exploiting udev Rules

Stroz Friedberg discovered sedexp, a stealthy Linux malware that utilizes udev rules to achieve persistence and evade detection. It provides reverse shell capabilities and advanced concealment tactics. Employed by a financially motivated threat actor, sedexp hides credit card scraping code, indicat…

Published: August 23, 2024

Downloadable IOCs: 3

Akira Ransomware Targets the LATAM Airline Industry

An in-depth analysis examined a threat actor utilizing Akira ransomware to compromise a Latin American airline. The attacker gained initial network access via SSH, exploiting a vulnerability in Veeam backup software, and subsequently exfiltrated critical data before deploying the ransomware payload…

Published: July 16, 2024

Downloadable IOCs: 2

Turning Jenkins Into a Cryptomining Machine From an Attacker's Perspective

This report analyzes how threat actors can exploit misconfigured Jenkins servers to execute malicious Groovy scripts, leading to activities like deploying cryptocurrency miners. Misconfigurations exposing the /script endpoint allow remote code execution, enabling attackers to run scripts that downl…

jenkins script console

Published: July 5, 2024

Downloadable IOCs: 4

DISGOMOJI Malware Used to Target Indian Government

Volexity identified a cyber-espionage campaign by a suspected Pakistan-based threat actor tracked as UTA0137 targeting government entities in India. The campaign leveraged the DISGOMOJI malware, a Golang-based Linux trojan that uses Discord for command and control via emojis. Key capabilities inclu…

Published: June 18, 2024

Downloadable IOCs: 149

Kiteshield Packer is Being Abused by Linux Cyber Threat Actors

This analysis uncovers the use of Kiteshield packer by various cybercriminal groups to evade detection on Linux platforms. The researchers reverse-engineered samples from APT group Winnti, cybercrime group DarkMosquito, and a script kiddie operation, revealing Kiteshield's anti-debugging techniques…

Published: May 29, 2024

Downloadable IOCs: 4

Springtail: New Linux Backdoor Added to Toolkit

Symantec's Threat Hunter Team has uncovered a new Linux backdoor, named Gomir, developed by the North Korean Springtail espionage group, which is linked to malware employed in a recent campaign targeting organizations in South Korea. The backdoor shares extensive code similarities with the Windows-…

Published: May 16, 2024

Downloadable IOCs: 20

Ebury is alive but unseen: 400k Linux servers compromised for cryptotheft and financial gain

The Ebury malware gang is continuing to expand, with hundreds of thousands of servers compromised and used to steal cryptocurrency and credit card data, according to a paper published by ESET Research on 14 May 2024.

Published: May 15, 2024

Downloadable IOCs: 141

New Goldoon Botnet Targeting D-Link Devices

In April 2024, FortiGuard Labs observed a new botnet exploiting a nearly decade-old D-Link vulnerability to take control of devices and incorporate them into a botnet used to launch attacks. The malware, named Goldoon, establishes persistence and connects to a C2 server to receive commands, includi…

Published: May 3, 2024

Downloadable IOCs: 24

Linux Trojan - Xorddos with Filename eyshcjdmzg

This analysis examines a recurring Linux trojan called Xorddos, which is a distributed denial-of-service (DDoS) malware. It provides details on various file hashes associated with the malware, as well as indicators of compromise (IOCs) such as IP addresses, domains, and email addresses. The analysi…

Published: May 1, 2024

Downloadable IOCs: 11

Tag: linux

Attack reports

Auto-Color: An Emerging and Evasive Linux Backdoor

You've Got Malware: FINALDRAFT Hides in Your Drafts

From South America to Southeast Asia: The Fragile Web of REF7707

Chinese Hackers Attacking Linux Devices With New SSH Backdoor

Deep Dive Into a Linux Rootkit Malware

Warning of a surge in activity associated with FICORA and Kaiten botnets

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

cShell DDoS Bot Attack Case Targeting Linux SSH Server (screen and hping3)

A Deep Dive into TeamTNT and Spinning YARN

Unpacking the Diicot Malware Targeting Linux Environments

First UEFI bootkit malware for Linux discovered

Unveiling WolfsBane: Linux counterpart to Gelsevirine

Helldown Ransomware: an overview of this emerging threat

Akira ransomware continues to evolve

THREAT ANALYSIS: Beast Ransomware

New Linux Malware Targeting ATMs for Financial Fraud

FASTCash for Linux

Lynx Ransomware: A Rebranding of INC Ransomware

From Perfctl to InfoStealer

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

OSINT Investigation: Hunting Malicious Infrastructure Linked to Transparent Tribe

Hadooken Malware Targets Weblogic Applications

Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401

Unveiling sedexp: A Stealthy Linux Malware Exploiting udev Rules

Akira Ransomware Targets the LATAM Airline Industry

Turning Jenkins Into a Cryptomining Machine From an Attacker's Perspective

DISGOMOJI Malware Used to Target Indian Government

Kiteshield Packer is Being Abused by Linux Cyber Threat Actors

Springtail: New Linux Backdoor Added to Toolkit

Ebury is alive but unseen: 400k Linux servers compromised for cryptotheft and financial gain

New Goldoon Botnet Targeting D-Link Devices

Linux Trojan - Xorddos with Filename eyshcjdmzg