Jump to content

FontOnLake malware infects Linux systems via trojanized utilities


Recommended Posts

Posted

via Bleeping Computer at FontOnLake malware infects Linux systems via trojanized utilities:
 

Quote
A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components.

The malware has a low prevalence in the wild and benefits from an advanced design that allows it to maintain extended persistence on an infected system.

Hiding inside legit utilities
FontOnLake has multiple modules that interact with one another and enable communication with malware operators, stealing sensitive data, and staying hidden on the system.

Researchers at ESET found multiple samples of the malware uploaded to the VirusTotal scanning service throughout last year, the first one appearing in May 2020.

Marked by stealth and sophisticated design, FontOnLake is likely used in targeted attacks by operators that are sufficiently careful to use unique command and control (C2) servers for “almost all samples” and various non-standard ports.

While ESET researchers found that the distribution method for FontOnLake is via trojanized application, they do not know how victims are lured to download the modified binaries.

Among the Linux utilities that the threat actor altered to deliver FontOnLake are:
 
  • cat - used to print the content of a file
  • kill - lists all running processes
  • sftp - secure FTP utility
  • sshd - the OpenSSH server process
 


More in the referenced article.

  • Thanks 2
  • +1 1

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...