Wednesday, October 9, 2024
HomeCyber Security NewsHackers Deployed never-before-seen Linux Malware Attacking Government Entities

Hackers Deployed never-before-seen Linux Malware Attacking Government Entities

Published on

Recent reports indicate that threat actors have been using a new type of Linux-targeted backdoor that has never been seen before. This new backdoor has been named SprySOCKS, which uses the strings of Trochilus (Windows backdoor) and the new Socket Secure (SOCKS).

However, this threat vector is carried out by the Earth Lusca threat group. This China-linked attacking group targeted several government departments of foreign affairs, technology, and telecommunications in many countries, including Latin American and African countries.

This threat group has now been found to be targeting the public-facing servers of its victims and exploiting server-based N-day vulnerabilities as part of their operation. 

- Advertisement - EHA

New Linux Malware

On further analyzing the new backdoor, it was discovered that the encrypted file that was found also included some activities of the Derusbi malware as it implemented an interactive Linux shell. 

The command and control structure of the protocol was found to be inspired by the  RedLeaves backdoor, a remote access trojan (RAT). Moreover, two different payloads were detected consisting of different version numbers, indicating that the malware is still under development.

According to a report shared with Cyber Security News, Earth Lusca is using server vulnerabilities to break into the victim’s network and deploy a web shell. Once inside the network, they install a Cobalt Strike for lateral movement. 

Furthermore, the threat group steals documents and email account credentials in order to further deploy advanced backdoors like ShadowPad and Winnti (Linux version) for persistent access into the affected systems.

Document
Get a Demo

Start protecting your SaaS data in just a few minutes!

With DoControl, you can keep your SaaS applications and data safe and secure by creating workflows tailored to your needs. It’s an easy and efficient way to identify and manage risks. You can mitigate the risk and exposure of your organization’s SaaS applications in just a few simple steps.

Vulnerabilities exploited by Earth Lusca

Earth Lusca leverages several critical and high vulnerabilities relating to an authentication bypass (CVE-2022-40684) and remote code execution (CVE-2022-39952, CVE-2021-22205, CVE-2019-18935, CVE-2019-9670 and CVE-2019-9621).

In addition, a set of three chained vulnerabilities can be combined together for performing a remote code execution. However, products affected by these vulnerabilities include Fortinet (FortiOS, FortiNAC, FortiProxy, and FortiSwitchManager), Zimbra Collaboration Suite, ASP.NET AJAX, GitLab, and Microsoft Exchange.

Trend Micro has published a complete report, which provides detailed information about the exploitation methods, payload components, and Attribution. 

Indicators of Compromise

Modified Mandibule Loader
65B27E84D9F22B41949E42E8C0B1E4B88C75211CBF94D5FD66EDC4EBE21B7359
Encrypted SprySOCKS payload (libmonitor.so.2)
6F84B54C81D29CB6FF52CE66426B180AD0A3B907E2EF1117A30E95F2DC9959FC
SprySOCKS (Decrypted)
F8BA9179D8F34E2643EE4F8BC51C8AF046E3762508A005A2D961154F639B2912
EEBD75AE0CB2B52B71890F84E92405AC30407C7A3FE37334C272FD2AB03DFF58
Delivery Server
207[.]148.75.122
SprySOCKS C&C server
lt76ux.confenos.shop
2e6veme8xs.bmssystemg188.us

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Badge and CyberArk Announce Partnership to Redefine Privacy in PAM and Secrets Management

Partnership aims to help businesses eliminate vulnerable attack surfaces and provide a more streamlined...

LemonDuck Malware Exploiting SMB Vulnerabilities To Attack Windwos Servers

The attackers exploited the EternalBlue vulnerability to gain initial access to the observatory farm,...

Critical Automative 0-Day Flaws Let Attackers Gain Full Control Over Cars

Recent discoveries in the automotive cybersecurity landscape have unveiled a series of critical zero-day...

Likho Hackers Using MeshCentral For Remotely Managing Victim Systems

The Awaken Likho APT group launched a new campaign in June of 2024 with...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Likho Hackers Using MeshCentral For Remotely Managing Victim Systems

The Awaken Likho APT group launched a new campaign in June of 2024 with...

Hackers Gained Unauthorized Network Access to Casio Networks

Casio Computer Co., Ltd. has confirmed that a third party illegally accessed its network...

Open-Source Scanner Released to Detect CUPS Vulnerability

A new open-source scanner has been released to detect a critical vulnerability in the...