New Undetectable Plague Malware Targeting Linux Servers for Persistent SSH Access

Security researchers have discovered a sophisticated Linux backdoor dubbed “Plague” that has remained undetected by all major antivirus engines despite multiple samples being uploaded to VirusTotal over the past year.

The malicious software operates as a Pluggable Authentication Module (PAM), allowing attackers to silently bypass system authentication and maintain persistent SSH access to compromised Linux systems.

Zero Detection Despite Year-Long Activity

The Plague backdoor represents a significant security concern due to its complete evasion of traditional detection methods.

Despite several variants being uploaded to VirusTotal throughout 2024 and into 2025, not a single antivirus engine among the 66 tested has flagged any sample as malicious.

Analysis of the threat landscape reveals active development and adaptation by the attackers, with samples compiled across different time periods and environments using various GCC compiler versions.

The earliest known sample dates back to July 2024, with the most recent submissions occurring as late as March 2025.

Compilation artifacts show the use of different Linux distributions, including Debian and Ubuntu systems, suggesting widespread deployment across diverse environments.

One particularly intriguing sample named “hijack” may provide clues to the malware’s origins, while hidden references to the 1995 movie “Hackers” appear in deobfuscated code, displaying the message: “Uh. Mr. The Plague, sir? I think we have a hacker.”

Advanced Obfuscation and Stealth Capabilities

Plague employs sophisticated technical features designed to evade detection and analysis.

The backdoor utilizes evolving string obfuscation techniques that have progressed from simple XOR-based encryption to complex methods resembling Key Schedule Algorithm (KSA) and Pseudo-Random Generation Algorithm (PRGA) routines.

The most recent variants incorporate an additional Deterministic Random Bit Generator (DRBG) layer, making analysis increasingly difficult.

Key technical capabilities include:

• Anti-debugging mechanisms that verify the actual filename is “libselinux.so.8” and ensure “ld.so.preload” is not present in environment variables.
• Environment detection to identify and evade sandbox environments and debugging tools that rely on preload mechanisms.
• Active sanitization of runtime environments by unsetting SSH-related variables such as SSH_CONNECTION and SSH_CLIENT.
• History manipulation by redirecting HISTFILE to /dev/null to prevent shell command logging and eliminate audit trails.

These features allow the malware to operate undetected while systematically removing evidence of attacker activity from both interactive sessions and system history logs.

Detection Methods and Security Implications

Security researchers have developed specialized tools to combat this threat, including a custom string deobfuscation utility using the Unicorn emulation framework within IDA Pro.

The tool safely emulates the malware’s decryption routines without executing the malicious code, allowing analysts to extract and annotate encrypted strings even as obfuscation methods evolve.

Several hardcoded passwords have been identified across different samples, including “Mvi4Odm6tld7,” “IpV57KNK32Ih,” and “changeme,” which enable unauthorized access without proper authentication.

Researchers have released YARA detection rules targeting specific function names like “decrypt_phrase” and “init_phrases” that appear consistently across variants.

The discovery of Plague highlights the critical vulnerability of foundational system components like PAM to sophisticated attacks.

Its ability to persist through system updates while leaving minimal forensic traces demonstrates the evolving threat landscape facing Linux infrastructure.

This case underscores the importance of proactive threat hunting using behavioral analysis and specialized detection tools beyond traditional antivirus solutions.

Indicators of Compromise (IoCs):

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!