ESET researchers have identified multiple samples of two previously unknown Linux backdoors: WolfsBane and FireWood.

allowing a simple command like eval read more about Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

using "chmod" to grant execute permissions read more about Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware

and clears forensic environment variables read more about New stealthy Quasar Linux malware targets software developers

Researchers uncover 14 malicious npm packages that secretly install RedC2 4.0, an AI-assisted command-and-control framework designed to maintain stealthy access to Linux servers.

At a glance Actor or group Suspected DPRK APTs (APT37 links, medium confidence) Activity type Linux backdoor, watering-hole injection, credential theft Targets or victims South Korean media and automotive organizations Scale Two confirmed victims; likely long-term espionage Jurisdiction or status No arrests or indictments reported Source Rapid7 Labs; Kaspersky; Mandiant TL;DR Rapid7 Labs found a stealthy Linux toolkit named the ted backdoor.

At a Glance Malware family XMRig cryptominer deployed via Redis abuse Threat actor Unnamed operator (suspected single actor, linked by wallet reuse) Target / victims 3,562 internet-facing Redis servers, mostly APAC cloud hosts Delivery vector Redis rogue replication (SLAVEOF) into cron injection Key capabilities Cron persistence, XMRig mining, C2 heartbeat, multi-path fallback Source

At a Glance Actor or group Suspected Gambling Goblin (linked to Earth Berberoka) Activity type SEO poisoning, reverse-proxy manipulation, credential theft Targets or victims Brazilian federal, state, and municipal government servers Scale Dozens of public-sector web portals and municipal domains Jurisdiction or law-enforcement status Active cybercrime threat; no arrests announced Sources Check Point Research, Trend Micro TL;DR Security researchers discovered a wide cybercrime…

At a Glance Malware family Poisoned Refresh (Linux rootkit implant) Threat actor Unconfirmed (tracked by F5 as activity cluster c05d5254) Target or victims F5 BIG-IP Access Policy Management (APM) environments Delivery vector Exploitation of unauthenticated RCE flaw CVE-2025-53521 Key capabilities Custom ELF loader, memory patching, fileless PHP web shell, local UNIX socket shell Source SophosLabs, ESET, F5 Networks TL;DR Security researchers at SophosLabs analyzed a stealthy Linux implant targeting…

Two South Korean organizations have been identified as being infected with a previously undocumented Linux backdoor embedded directly within custom versions of HAProxy load balancers. Based on debug strings found in the binary, Ted was able to intercept web traffic and deliver modified content to selected users.  The activity was attributed with medium confidence to North Korean state-sponsored threat actors by Rapid7 Labs. Affected organizations are members of South Korea’s automotive and media industries. As a result, Ted implant appears to have been designed to maintain access to compromised systems while remaining difficult to detect by routine monitoring.  The Ted implant did not result from a vulnerability in HAProxy. An attacker must obtain code execution on the affected host in order to deploy the backdoor, which requires replacing the legitimate HAProxy binary with a modified version. As observed, the backdoor is bundled with HAProxy 2.8.12, enabling the malicious code to operate alongside the load balancer's legitimate functions.  As opposed to running as a separate suspicious process, Ted utilizes HAProxy’s filter API, memory pools, event scheduler and process management components. It is possible for the implant to observe HTTP traffic while the server is performing normal load-balancing activities. It is possible to monitor high-value web requests, capture session cookies, and identify certain clients for traffic manipulation using the backdoor. Additionally, malicious scripts may be injected into pages delivered to targeted visitors.  The integration of this activity with an existing network component makes it difficult to identify the activity by conventional process or file-based monitoring mechanisms. Additionally, Ted is equipped with a concealed command-and-control feature. By sending a request to the filter targeting specific image paths, the filter will be switched to C2 mode. This implant manages the command traffic within HAProxy rather than forwarded to a backend server, while removing the connection from HAProxy's live connection counter. After writing the command data to /tmp, the request channel is cleared. A load balancer terminates the connection, preventing the backend server from receiving a corresponding request. Therefore, neither backend logs nor HAProxy's normal connection statistics are able to provide a detailed account of C2 activity.  Rapid7 emphasized that additional evidence must be provided before definitively attribution can be made to North Korean operators. This assessment is supported by the targeting of South Korean organisations, combined with the infrastructure and malware characteristics associated with activities linked to the DPRK.  In addition to the HAProxy implant, Rapid7 identified a more comprehensive toolkit. During the same operation, modified versions of crond, sshd, Agetty, Atd, and Pollkitd were also utilized, giving operators a number of ways to maintain access and collect data from compromised systems. Upon discovering the stager, it was discovered that the additional components were only deployed on systems that already contained HAProxy or cron.  The malicious replacement for crond was also crafted to closely replicate the legitimate system binary, including adopting a matching creation timestamp, prior to proceeding. The shell history was also modified to remove references to commands and files involved in the intrusion, as well as several system logs were modified to minimize evidence of the intrusion. SSHd was trojanized to serve a direct credential theft function. It captured plaintext passwords before encrypting and storing them at a fixed location on the compromised host. Rapid7 tracked curlRAT as another component that provided operators with remote access and communication. It normally contacts its control infrastructure every 12 hours, but may switch to a 30-second interval if instructed to do so. Prior to being executed, the malware also checked for a marker indicating that the system was virtualized.  Attribution Points to North Korean Activity In Rapid7's assessment, North Korean state-sponsored actors were identified as being responsible for the campaign. It is consistent with an espionage-focused operation that South Korean automotive and media companies were targeted, even though available evidence does not specify how the victims were initially compromised.  APT37-associated threat intelligence records contain some infrastructure linked to the toolkit. However, Rapid7 cautions that the evidence spans several North Korean threat clusters, making attribution more difficult because the broader delivery approach is similar to previous campaigns targeting South Korean organizations. SyncHole, which was an earlier campaign that selectively redirected visitors to South Korean websites, also has similarities to the research. In campaigns designed to target specific users without disrupting normal website activity, traffic filtering and selective content delivery remain effective techniques.  HAProxy Builds Create a Difficult Detection Problem There was an infection in both affected organizations with HAProxy 2.8.12, released in November 2024. The implant is based on internal structures related to that specific release, suggesting that the malicious code has been constructed around existing software environments in both organisations. In addition to updating HAProxy, the threat resides within a replaced binary, rather than exploiting a HAProxy flaw, and would not be removed by updating alone. The case also emphasizes the difficulty of identifying malicious code embedded in trusted infrastructure when it is complemented by network correlation and memory-based behavioral analysis.  In addition to continuing to handle legitimate traffic normally, a compromised load balancer provides attackers with a concealed position through which they can inspect traffic, collect credentials, and execute commands.

MalwareHunterTeam analyzed a low-detection Linux ELF backdoor named gregbfdah.png that was delivered from an AWS S3 URL and uploaded to VirusTotal in June 2026. The implant uses AES-128-GCM and MessagePack for configuration and C2 communication, and it supports registration, command execution, file operations, and reverse pivot tunneling. #MalwareHunterTeam #gregbfdah.png #VirusTotal #iot.981666.xyz

A malicious library can hide among ordinary system files for years. A newly discovered Linux backdoor exploits exactly that technique to target iKuai routers. The sample arrived on VirusTotal on July 1 with zero detections. However, the file was first uploaded from Japan as early as June 8. A detailed technical analysis of the iKuai router backdoor is available for researchers who want to examine indicators and behavioral details.

Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. "Showboat is a modular post-exploitation framework designed for Linux systems, capable of spawning a remote shell, transferring files, and functioning as a SOCKS5 proxy," Lumen

The recently observed Hadooken malware targeting Oracle WebLogic applications is linked to multiple ransomware families.