FontOnLake malware infects Linux systems via trojanized utilities

[Corrine]

via Bleeping Computer at FontOnLake malware infects Linux systems via trojanized utilities:
 

Quote

A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components.

The malware has a low prevalence in the wild and benefits from an advanced design that allows it to maintain extended persistence on an infected system.

Hiding inside legit utilities
FontOnLake has multiple modules that interact with one another and enable communication with malware operators, stealing sensitive data, and staying hidden on the system.

Researchers at ESET found multiple samples of the malware uploaded to the VirusTotal scanning service throughout last year, the first one appearing in May 2020.

Marked by stealth and sophisticated design, FontOnLake is likely used in targeted attacks by operators that are sufficiently careful to use unique command and control (C2) servers for “almost all samples” and various non-standard ports.

While ESET researchers found that the distribution method for FontOnLake is via trojanized application, they do not know how victims are lured to download the modified binaries.

Among the Linux utilities that the threat actor altered to deliver FontOnLake are:
 

• cat - used to print the content of a file
• kill - lists all running processes
• sftp - secure FTP utility
• sshd - the OpenSSH server process

 

More in the referenced article.

[securitybreach]

Interesting.