Press/academia
- https://en.wikipedia.org/wiki/Linux_malware - DarkSide
- https://en.wikipedia.org/wiki/Mirai_(malware) - Mirai
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - LaZagne, Dalcs, Gafgyt, Tsunami, IPStorm, Wellmess, FritzFrog
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf - WINNTI
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - AgeLocker, WellMail, TrickBot, IPStorm, Turla, QNAPCrypt, Carbanak
- https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf- various SSH, Bonadan, Kessel, Chandrila
- https://www.botconf.eu/wp-content/uploads/2018/12/2018-R-Dumont-H-Porcher-dark_side_of_the_forsshe.pdf - various SSH, Bonadan, Kessel, Chandrila
- https://ieeexplore.ieee.org/document/8418602
- https://gist.github.com/vlamer/2c2ec2ca80a84ab21a32
- http://s3.eurecom.fr/~invano/slides/recon18_linux_malware.pdf
- https://reyammer.io/publications/2018_oakland_linuxmalware.pdf
- https://malpedia.caad.fkie.fraunhofer.de/
- https://rp.os3.nl/
- https://wikileaks.org/vault7/
Breach reports
Supply chain attacks
- https://www.webmin.com/exploit.html - Webmin
- ? - ProFTPd
- ? - UnrealIRCd
- ? - Horde Webmail
- ? - PHPMyAdmin
- ? - PHP
- ? - VsFTPd
- https://portswigger.net/daily-swig/homebrew-bug-allowed-researcher-full-access-to-github-repos - Homebrew
Malware reports
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/- FreakOut
- https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/- RandomEXX
- https://www.intezer.com/blog/research/a-storm-is-brewing-ipstorm-now-has-linux-malware/ - IPStorm
- https://cujo.com/iot-malware-journals-prometei-linux/ - Promotei
- https://twitter.com/IntezerLabs/status/1338480158249013250 - Promotei
- https://igor-blue.github.io/2021/03/24/apt1.html
- https://www.sentinelone.com/blog/darkradiation-abusing-bash-for-linux-and-docker-container-ransomware/ - DarkRadiation
- https://www.trendmicro.com/en_gb/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html - DarkRadation
- https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/ - RotaJakiro
- https://blogs.blackberry.com/en/2020/06/threat-spotlight-tycoon-ransomware-targets-education-and-software-sectors - Tycoon
- https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/ - QNAPCrypt, eCh0raix
- https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/ - QNAPCrypt, eCh0raix
- https://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/ - KillDisk
- https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version - REvil
- https://twitter.com/malwrhunterteam/status/1415403132230803460 - HelloKitty
- https://labs.sentinelone.com/hellokitty-ransomware-lacks-stealth-but-still-strikes-home/ - HelloKitty
- https://github.com/fboldewin/FastCashMalwareDissected/blob/master/Operation%20Fast%20Cash%20-%20Hidden%20Cobra%E2%80%98s%20AIX%20PowerPC%20malware%20dissected.pdf - FastCash #aix
- https://www.guardicore.com/labs/fritzfrog-a-new-generation-of-peer-to-peer-botnets/ - FritzFrog
- https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ - Gafgyt
- https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/ - Gafgyt
- https://twitter.com/malwaremustd1e/status/1264417940742389762 - Gafgyt
- https://twitter.com/malwaremustd1e/status/1265321238383099904 - Gafgyt
- https://imgur.com/a/2zRCt - Gafgyt
- https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-exploited-to-attack-gaming-servers/- Gafgyt
- https://www.uptycs.com/blog/mirai-code-re-use-in-gafgyt - Gafgyt
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - DarkSide
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ - Turian
- https://www.intezer.com/blog/malware-analysis/evilgnome-rare-malware-spying-on-linux-desktop-users/ - EvilGnome
- https://unit42.paloaltonetworks.com/watchdog-cryptojacking/ - WatchDog
- https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/ - RedXOR
- https://vms.drweb.com/virus/?_is=1&i=15389228 - ?
- https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/ - TeamTNT
- https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials - TeamTNT
- https://twitter.com/_larry0/status/1143532888538984448 - Silex
- https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/ - GodLua
- https://blog.talosintelligence.com/2018/05/VPNFilter.html - VPNFilter
- https://blog.talosintelligence.com/2018/06/vpnfilter-update.html - VPNFilter
- https://www.trendmicro.com/en_gb/research/19/f/cryptocurrency-mining-botnet-arrives-through-adb-and-spreads-through-ssh.html - CoinMiner
- https://www.microsoft.com/security/blog/2021/07/22/when-coin-miners-evolve-part-1-exposing-lemonduck-and-lemoncat-modern-mining-malware-infrastructure/ - LemonDuck
- https://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html - Mirai
- https://blog.malwaremustdie.org/2020/01/mmd-0065-2020-linuxmirai-fbot.html - Mirai
- https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html - Mirai
- https://imgur.com/a/qqgfFXf - Mirai
- https://imgur.com/a/53f29O9 - Mirai
- https://news.sophos.com/en-us/2020/12/16/systembc/ - SystemBC
- https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html - Slapstick #solaris
- https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF - Drovorub
- https://www.welivesecurity.com/2015/04/29/unboxing-linuxmumblehard-muttering-spam-servers/ - Mumblehard
- https://twitter.com/billyleonard/status/1417910729005490177 - Zirconium (APT31)
- https://twitter.com/bkMSFT/status/1417823714922610689 - Zirconium (APT31)
- https://www.cert.ssi.gouv.fr/ioc/CERTFR-2021-IOC-003/ - Zirconium (APT31)
- https://twitter.com/IntezerLabs/status/1326880812344676352 - AgeLocker
- https://twitter.com/IntezerLabs/status/1288487307369222145 - TrickBot
- https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html - NOTROBIN
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-cloud-snooper-report.pdf - Cloud Snooper
- https://blogs.jpcert.or.jp/en/2020/03/elf-tscookie.html - TSCookie
- https://twitter.com/ESETresearch/status/1382054011264700416 - TSCookie, #freebsd
- https://blogs.jpcert.or.jp/en/2020/11/elf-plead.html - PLEAD
- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability - KinSing
- https://www.leonardocompany.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf - Turla
- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ - Kaiji
- https://old.reddit.com/r/LinuxMalware/comments/gdte0m/linuxkaiji/ - Kaiji
- https://twitter.com/IntezerLabs/status/1272915284148531200 - Lazarus
- https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/ - Doki
- https://blog.netlab.360.com/a-new-mining-botnet-blends-its-c2s-into-ngrok-service/ - NGrok
- https://blog.trendmicro.com/trendlabs-security-intelligence/exposed-docker-control-api-and-community-image-abused-to-deliver-cryptocurrency-mining-malware/ - NGrok
- https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf - WellMail (APT29)
- https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF - Drovorub
- https://twitter.com/IntezerLabs/status/1291355808811409408 - Carbanak
- https://twitter.com/IntezerLabs/status/1300403461809491969 - Dalcs
- https://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/ - Rakos
- http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf - Moose
- https://www.intezer.com/blog/research/stantinkos-proxy-after-your-apache-server/ - Stantinkos
- https://unit42.paloaltonetworks.com/pgminer-postgresql-cryptocurrency-mining-botnet/ - PGMiner
- https://raw.githubusercontent.com/bg6cq/ITTS/master/security/mine/README.md - ITTS
- https://twitter.com/CraigHRowland/status/1422009387686645761 - ITTS
- https://twitter.com/CraigHRowland/status/1422267857988063232 - ITTS
- https://pastebin.com/raw/mEape37E - SystemTen
- https://imgur.com/a/H7YuWuj - SystemTen
- https://old.reddit.com/r/LinuxMalware/comments/f26amt/new_systemten_botnet_miner_threat_now_wother/ - SystemTen
- https://twitter.com/malwaremustd1e/status/1235595880041873408 - Hajimi
- https://twitter.com/malwaremustd1e/status/1237080802581565440 - Mozi
- https://old.reddit.com/r/LinuxMalware/comments/fh3zar/memo_rhombus_an_elf_bot_installerdropper/ - Rhombus
- https://twitter.com/malwaremustd1e/status/1251758225919115264 - Tsunami, Kaiten
- https://gist.github.com/unixfreaxjp/7b8bd6be614f7a051fc9a9da760d3138 - Tsunami, Kaiten
- https://twitter.com/malwaremustd1e/status/1267068856645775360 - DarkNexus
- https://twitter.com/malwaremustd1e/status/1380637310346096641 - Ngioweb
- https://twitter.com/malwaremustd1e/status/1379028201075187716 - DGAbot
- https://imgur.com/a/8mFGk - httpsd
- https://old.reddit.com/r/LinuxMalware/comments/7qd27e/linuxss_aka_shark_hacktool_syn_scanner_wpcap/- SS, Shark
- https://old.reddit.com/r/LinuxMalware/comments/a66dsz/ddostf_still_lurking_arm_boxes/ - DDoSTF
- https://imgur.com/a/N3BgY - ChinaZ, GoARM
- https://imgur.com/a/5vPEc - ChinaZ
- https://imgur.com/a/vS7xV - CarpeDiem
- https://imgur.com/a/eBF7Mqe - Haiduc
- https://imgur.com/a/SSKmu - Rebirth, Vulcan
- https://imgur.com/a/lAQ1tMQ - HelloBot
- https://imgur.com/a/4YxuSfV - Cayosin
- https://imgur.com/a/57uOiTu - DDoSMan
- https://imgur.com/a/MuHSZtC - Mandibule
- https://imgur.com/a/CtHlmBE - Tsunami, Kaiten
- https://imgur.com/a/qI5Fvm4 - STD
- https://imgur.com/a/DWKK5 - Tsunami, Kaiten
- https://imgur.com/a/LpTN7 - Elknot
- https://imgur.com/a/y5BRx - r57shell
- https://imgur.com/a/a6RaZMP - Honda Car's Panel's Rootkit from China #Android
- https://pastebin.com/iKyaqLTd - Exaramel, BlackEnergy, #ICS
- https://pastebin.com/Z3sXqDCA - Mozi
- https://blog.malwaremustdie.org/2019/09/mmd-0064-2019-linuxairdropbot.html - AirDropBot
- https://imgur.com/a/Ak9zICq - Neko
- https://twitter.com/ESETresearch/status/1415542456360263682 - ?, #FreeBSD
- https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/ - Kobalos, #Linux, #BSD, #Solaris, #AIX
- https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf - Kobalos, #bsd, #solaris, #aix
- https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/ - Ebury
- https://www.welivesecurity.com/2018/12/05/dark-side-of-the-forsshe/kessel-dns-exfiltration-2/ - Kessel
- https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/ - Prophet Spider
- https://twitter.com/malwrhunterteam/status/1422972905541996546 - Encryptor, #VMware
Malware samples
- https://bazaar.abuse.ch/browse.php?search=tag%3Aelf
- https://github.com/MalwareSamples/Linux-Malware-Samples
- https://twitter.com/nunohaien/status/1261281420791742464
- https://www.virustotal.com/gui/file/c69ee0f12a900adc654d93aef9ad23ea56bdfae8513e534e1a11dca6666d10aa/detection
- https://github.com/0x27/linux.mirai- Mirai
- https://bazaar.abuse.ch/browse/signature/Mirai/ - Mirai
- https://bazaar.abuse.ch/browse/signature/Gafgyt/ - Gafgyt
- https://bazaar.abuse.ch/browse/signature/XorDDoS/ - XorDDoS
- https://bazaar.abuse.ch/browse/signature/SystemBC/ - SystemBC
- https://www.virustotal.com/gui/file/1d60edb577641ce47dc2a8299f8b7f878e37120b192655aaf80d1cde5ee482d2/detection - Zirconium (APT31)?
- https://github.com/eset/malware-ioc/tree/master/rakos - Rakos
- https://analyze.intezer.com/files/85e72976b9448295034a8d4c26462b8f1ebe1ca0a4e4b897c7f2404d0de948c2- WellMail (APT29)
Research, PoCs, capabilities etc
Not necessarily malicious code (see Linikatz and unix-privesc-check =)) but interesting capabilities...
Tools
- https://github.com/AlessandroZ/LaZagne
- https://github.com/CiscoCXSecurity/linikatz
- https://github.com/ciscocxsecurity/unix-privesc-check
- https://github.com/rebootuser/LinEnum
- https://github.com/rek7/fireELF
- https://github.com/ripmeep/memory-injector
- https://github.com/zMarch/Orc
- https://github.com/TH3xACE/SUDO_KILLER
- https://github.com/CiscoCXSecurity/sudo-parser
- https://github.com/NetDirect/nfsshell
- https://github.com/phath0m/JadedWraith
- https://github.com/FiloSottile/age
- https://github.com/oldboy21/LDAP-Password-Hunter
- https://github.com/redcode-labs/Bashark
- https://github.com/jtripper/parasite
- https://github.com/ixty/mandibule
- https://github.com/f0rb1dd3n/Reptile
- https://github.com/nurupo/rootkit
- https://github.com/adamcaudill/EquationGroupLeak/tree/master/Linux
- https://github.com/mempodippy/vlany
- https://github.com/m1m1x/memdlopen
- https://github.com/ropnop/kerbrute
- https://github.com/ropnop/windapsearch
- https://github.com/CiscoCXSecurity/enum4linux
- https://gtfobins.github.io/
Techniques
- https://tmpout.sh/1/
- https://n0.lol/
- https://vxug.fakedoma.in/papers.html
- https://github.com/willshiao/node-bash-obfuscate
- https://www.tarlogic.com/blog/how-to-attack-kerberos/
- https://github.com/CiscoCXSecurity/linikatz/issues
- https://www.first.org/resources/papers/telaviv2019/Rezilion-Shlomi-Butnaro-Beyond-Whitelisting-Fileless-Attacks-Against-L....pdf
- https://gist.github.com/timb-machine/7bd75479ee29aee8762952ea16908eb0
- https://rp.os3.nl/2016-2017/p59/report.pdf
- https://rp.os3.nl/2016-2017/p59/presentation.pdf
- https://rp.os3.nl/2016-2017/p97/report.pdf
- https://rp.os3.nl/2016-2017/p97/presentation.pdf
- https://github.com/alichtman/malware-techniques
- https://security.humanativaspa.it/openssh-ssh-agent-shielded-private-key-extraction-x86_64-linux/
- http://www.nth-dimension.org.uk/downloads.php?id=77
- https://labs.portcullis.co.uk/presentations/breaking-the-links-exploiting-the-linker/
- https://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/
- http://archive.hack.lu/2019/Fileless-Malware-Infection-and-Linux-Process-Injection-in-Linux-OS.pdf
- http://shell-storm.org/api/?s=arm
Sandboxes
- https://github.com/monnappa22/Limon
- https://bazaar.abuse.ch/
- https://www.virustotal.com/gui/
- https://www.rfxn.com/projects/linux-malware-detect/
- https://elfdigest.com/
*Beware click the link!
Sandidi
Rei
Karno si kribo
