Advanced Linux backdoor found in the wild escaped AV detection

Researchers say they’ve discovered an advanced piece of Linux malware that has escaped detection by antivirus products and appears to be actively used in targeted attacks.

HiddenWasp, as the malware has been dubbed, is a fully developed suite of malware that includes a trojan, rootkit, and initial deployment script, researchers at security firm Intezer reported on Wednesday. At the time Intezer’s post went live, the VirusTotal malware service indicated Hidden Wasp wasn’t detected by any of the 59 antivirus engines it tracks, although some have now begun to flag it. Time stamps in one of the 10 files Intezer analyzed indicated it was created last month. The command and control server that infected computers report to remained operational at the time this article was being prepared.

Some of the evidence analyzed—including code showing that the computers it infects are already compromised by the same attackers—indicated that HiddenWasp is likely a later stage of malware that gets served to targets of interest who have already been infected by an earlier stage. It’s not clear how many computers have been infected or how any earlier related stages get installed. With the ability to download and execute code, upload files, and perform a variety of other commands, the purpose of the malware appears to be to remotely control the computers it infects. That's different from most Linux malware, which exists to perform denial of service attacks or mine cryptocurrencies.

Wake up call

“Linux malware may introduce new challenges for the security community that we have not yet seen in other platforms,” Intezer researcher Ignacio Sanmillan wrote in Wednesday’s post. “The fact that this malware manages to stay under the radar should be a wake up call for the security industry to allocate greater efforts or resources to detect these threats.”

Some of the code appears to be borrowed from Mirai, the Internet-of-things botnet malware whose source code became publicly available in 2016. Other code has similarities to other established projects or malware including the Azazel rootkit, the ChinaZ Elknot implant, and the recently discovered Linux variant of Winnti, a family of malware that previously had been seen targeting only Windows.

In an email, Silas Cutler, lead reverse engineer for Chronicle, the Alphabet-owned security firm that discovered the Winnti Linux variant, wrote:

What was really interesting about the case was that many of the tools for Linux are fairly rudimentary. Even in the case of Winnti-Linux, it was a port of the Windows variant. Borrowing code from open-source projects like Azazel—and (now) Mirai is interesting because ... it may be to masquerade the malware/mislead analysts.

Most Linux malware is, as Intezer stated, focused on DDoS or mining. This malware variant being focused on direct actor control is unique. The intention of this malware . . . is really interesting compared to most *nix stuff. [The developers are] using an open-sourced rootkit to facilitate that access.

The rootkit component, Azazel, is really only for hiding operations. While the Azazel and Mirai links were focused on in the report, ChinaZ elements were reportedly found—which makes me think that the actors were experimenting with combining several tool sets.

The computer that first uploaded one of the HiddenWasp files to VirusTotal used the path containing the name of a Chinese-based forensics company known as Shen Zhou Wang Yun Information Technology Co., Ltd.. The operators also rented servers from Hong Kong-based server hosting company ThinkDream to host their malware.

One of the files uploaded to VirusTotal, a bash script that appears to have been used for testing purposes, led Intezer researchers to a different file. The new file included the user name and password for accounts that appear to have already been added to give attackers persistent access. This evidence led Intezer to believe the malware gets installed on machines that attackers have already compromised. It’s common for advanced malware to come in two or more stages in an attempt to keep infections from being detected and prevent unintended damage.

Since Wednesday’s post went live, AV detection rates have grown, but at the time Ars published this article, the rates still remained low. Depending on the file being analyzed, the rates ranged from two to 13, out of 59 AV engines tracked.

The VirusTotal links are:

• https://www.virustotal.com/#/file/e9e2e84ed423bfc8e82eb434cede5c9568ab44e7af410a85e5d5eb24b1e622e3/detection
• https://www.virustotal.com/#/file/f321685342fa373c33eb9479176a086a1c56c90a1826a0aef3450809ffc01e5d/detection
• https://www.virustotal.com/#/file/d66bbbccd19587e67632585d0ac944e34e4d5fa2b9f3bb3f900f517c7bbf518b/detection
• https://www.virustotal.com/#/file/0fe1248ecab199bee383cef69f2de77d33b269ad1664127b366a4e745b1199c8/detection
• https://www.virustotal.com/#/file/2ea291aeb0905c31716fe5e39ff111724a3c461e3029830d2bfa77c1b3656fc0/detection
• https://www.virustotal.com/#/file/d596acc70426a16760a2b2cc78ca2cc65c5a23bb79316627c0b2e16489bf86c0/detection
• https://www.virustotal.com/#/file/609bbf4ccc2cb0fcbe0d5891eea7d97a05a0b29431c468bf3badd83fc4414578/detection
• https://www.virustotal.com/#/file/8e3b92e49447a67ed32b3afadbc24c51975ff22acbd0cf8090b078c0a4a7b53d/detection
• https://www.virustotal.com/#/file/f38ab11c28e944536e00ca14954df5f4d08c1222811fef49baded5009bbbc9a2/detection
• https://www.virustotal.com/#/file/8914fd1cfade5059e626be90f18972ec963bbed75101c7fbf4a88a6da2bc671b/detection

Chronicle researcher Brandon Levene uncovered this additional file.

Wednesday’s post lists indicators of compromise that people can use to tell if their computers have been infected. One telltale sign: “ld.so” files that don’t contain the string “/etc/ld.so.preload.” This is the result of the HiddenWasp trojan trying to patch instances of ld.so to enforce the LD_PRELOAD mechanism from arbitrary locations.