Corrine Posted October 10, 2021 Posted October 10, 2021 via Bleeping Computer at FontOnLake malware infects Linux systems via trojanized utilities: Quote A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components. The malware has a low prevalence in the wild and benefits from an advanced design that allows it to maintain extended persistence on an infected system. Hiding inside legit utilities FontOnLake has multiple modules that interact with one another and enable communication with malware operators, stealing sensitive data, and staying hidden on the system. Researchers at ESET found multiple samples of the malware uploaded to the VirusTotal scanning service throughout last year, the first one appearing in May 2020. Marked by stealth and sophisticated design, FontOnLake is likely used in targeted attacks by operators that are sufficiently careful to use unique command and control (C2) servers for “almost all samples” and various non-standard ports. While ESET researchers found that the distribution method for FontOnLake is via trojanized application, they do not know how victims are lured to download the modified binaries. Among the Linux utilities that the threat actor altered to deliver FontOnLake are: cat - used to print the content of a file kill - lists all running processes sftp - secure FTP utility sshd - the OpenSSH server process More in the referenced article. 2 1 Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.