Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

FontOnLake Malware Infects Linux Systems Via Trojanized Utilities

FontOnLake Malware Infects Linux Systems Via Trojanized Utilities

A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components.

The malware has a low prevalence in the wild and benefits from an advanced design that allows it to maintain extended persistence on an infected system.

Hiding inside legit utilities

FontOnLake has multiple modules that interact with one another and enable communication with malware operators, stealing sensitive data, and staying hidden on the system.

Researchers at ESET found multiple samples of the malware uploaded to the VirusTotal scanning service throughout last year, the first one appearing in May 2020.

Marked by stealth and sophisticated design, FontOnLake is likely used in targeted attacks by operators that are sufficiently careful to use unique command and control (C2) servers for “almost all samples” and various non-standard ports.

While ESET researchers found that the distribution method for FontOnLake is via trojanized application, they do not know how victims are lured to download the modified binaries.

Also Read: What is Pseudonymisation: 5 Techniques and Its Best Practices

Among the Linux utilities that the threat actor altered to deliver FontOnLake are:

  • cat – used to print the content of a file
  • kill – lists all running processes
  • sftp – secure FTP utility
  • sshd – the OpenSSH server process

“All the trojanized files are standard Linux utilities and serve as a persistence method because they are commonly executed on system start-up,” Vladislav Hrčka, malware analyst and reverse engineer at ESET,

Accordind to the researchers, the trojan utilities were likely modified at the source code level, indicating that the threat actor compiled them and replaced the original one.

Apart from carrying the malware, the role of these modified binaries is to load additional payloads, collect information, or execute other malicious actions.

The researchers discovered three custom backdoors written in C++ associated with the FontOnLake malware family, which provide operators remote access to the infected system.

A common function for all three of them is to transfer collected sshd credentials and bash command history to the C2 server. They also use custom heartbeat commands to keep alive the connection to the control server.

Based on open-source rootkit

In a technical report released this week, ESET notes that FontOnLake’s presence on a compromised system is hidden by a rootkit component, which is also responsible for updates and for the delivery of fallback backdoors.

Interaction of FontOnLake components
source: ESET

All rootkit samples that ESET found target kernel versions 2.6.32-696.el6.x86_64 and 3.10.0-229.el7.X86_64. The two versions discovered are based on an eight-year old open-source rootkit project called Suterusu and can hide processes, files, themselves, and network connections.

Communication between trojanized apps and the rootkit is through a virtual file that the latter creates. An operator can read or write data to this file and have it exported by the backdoor component.

The researchers believe that the author of FontOnLake is “well versed in cybersecurity” and deactivated the C2 servers used in the samples found on VirusTotal once they learned of the upload.

Also Read: 5 Simple Instructions on How to Access Request Form PDF

A puff of FontOnLake

ESET says that FontOnLake may be the same malware previously analyzed by researchers at Tencent Security Response Center, who associated it with an advanced persistent threat incident.

In a tweet in late August, cybersecurity company Avast announced they found a new Linux malware that uses Suterusu, which they named HCRootkit.

Their description is similar to ESET findings as HCRootkit is delivered by a “backdoored coreutils binary” that also drops a backdoor written in C++.

“The main purpose of the rootkit component is to hide the stage 2 payload and ensure the traffic from the CNC is bypassing the firewall by installing a netfilter hook and redirecting the CNC packets to make it look like the packets are coming from localhost” – Avast

Lacework Labs also published an analysis of HCRootkit, which shares details that seem to confirm that the malware is the same as FontOnLake.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us