Tuesday, May 13, 2025
HomeMalwareFontOnLake - Previously Unknown Malware Attack Linux Systems

FontOnLake – Previously Unknown Malware Attack Linux Systems

Published on

SIEM as a Service

Follow Us on Google News

A new modular Linux malware has been recently detected by ESET that is dubbed as FontOnLake. And this malware has many features, one of them is “well-designed modules.”

This feature is very well designed and is continuously being updated with an extensive range of skills, which generally indicates an active development stage.

However, the malicious code was utilized by the threat actors to negotiate all the data from infected systems and performances as a proxy server.

- Advertisement - Google News

Lurking under legit utilities

FontOnLake is quite dangerous in nature, as the malware has different modules that communicate with one another and simply allow communication with malware operators, after doing that it steals sensitive data, and keeps itself hidden on the system.

FontOnLake is likely practiced in targeted attacks by operators that are adequately careful to utilize the unique command and control (C2) servers for samples and different non-standard ports.

Components of FontOnLake

FontOnLake’s components have been divided into three following groups that generally communicate with each other, and here we have mentioned them below:-

  • Trojanized applications 
  • Backdoors 
  • Rootkits

Trojanized apps and Rootkits

In this malware, the threat actors have used several trojanized apps to load custom backdoor as well as rootkit modules. All the applications that are present in this malware serve as a constancy method

Since they are mostly used in start-ups, and not only this even all the trojanized files are standard Linux utilities.

There are two different versions of the rootkit, and those are used only one at a time. However, there are some similar functions of both the rootkit that were being discovered, and here we have mentioned them below:-

  • Process hiding
  • File hiding
  • Hiding itself
  • Hiding network connections
  • Exposing the collected credentials to its backdoor
  • Performing port forwarding
  • Magic packets reception

Backdoors

In this malware, there are three different backdoors that are written in C++, and all the backdoors exfiltrate the data that has been collected. All these different backdoors are not applied together on one negotiated system. 

Apart from this, all the backdoors use custom heartbeat commands that are probably sent and received regularly so that the connection stays alive.

The operators of this malware are well trained and know the exact way of implementing the attack. While most of the features of the malware are specifically designed to hide the presence, relay information, and implement backdoor access.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Zoom Workplace Apps Flaws Allow Hackers to Gain Elevated Access

Zoom has released multiple security bulletins addressing seven newly discovered vulnerabilities in Zoom Workplace...

PoC Exploit Published for macOS Sandbox Escape Vulnerability (CVE-2025-31258)

Security researchers have disclosed a new macOS sandbox escape vulnerability tracked as CVE-2025-31258, accompanied...

Four Hackers Caught Exploiting Old Routers as Proxy Servers

U.S. authorities unsealed charges against four foreign nationals accused of operating a global cybercrime...

F5 BIG-IP Vulnerability Allows Remote Command Execution

Critical security vulnerability in F5 BIG-IP systems has been discovered that allows authenticated administrators...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Researchers Uncover Remote IT Job Fraud Scheme Involving North Korean Nationals

The United States indicted fourteen North Korean nationals for orchestrating a sophisticated scheme to...

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...