Subj : Linux devices hit with ev
To   : Mike Powell
From : Ed Vance
Date : Wed Nov 27 2024 03:52 pm


>  * Originally in: TQW_GENTEC
>  * Originally on: 11-22-24 15:30
>  * Originally by: TechnologyDaily

> Linux devices hit with even more new malware, this time from Chinese hackers

> Date:
> Fri, 22 Nov 2024 15:29:00 +0000

> Description:
> WolfsBane is an all-in-one malware solution hitting Linux systems, experts
> warn.

> FULL STORY

> Chinese hackers have built new all-in-one malware to target Linux devices, a
> new report from cybersecurity researchers ESET , have said. 

> The WolfsBane malware features a dropper, launcher, a backdoor, and a
> modified open-source rootkit for detection evasion. While not completely
> outlandish, the approach is rather unconventional, since most hacking groups
> will develop just one of these features, and use other peoples solutions for
> the rest. 

> That being said, WolfsBanes key ability is to grant its operators total
> control over the compromised system. It can execute commands coming in from
> the C2 server, exfiltrate data, and ultimately - manipulate the system.

> Gelsemium is active 

> ESET doesnt know for certain how the attackers accessed the target systems to
> deploy the malware in the first place, but assesses with medium confidence
> that the group exploited an unknown web application vulnerability. 

> The group, in this instance, is called Gelsemium, suggesting that it has at
> least one herbalist in its ranks. Itis a relatively known Chinese group,
> active since at least 2014. It mostly targets government institutions,
> educational organizations, electronics manufacturers, and religious
> institutions. The majority of its victims are located in East Asia and the
> Middle Easts. 

> ESET also suggests that the group decided to target Linux since Windows
> defenses have been getting better lately. 

> "The trend of APT groups focusing on Linux malware is becoming more
> noticeable, ESET said. 

> We believe this shift is due to improvements in Windows email and endpoint
> security, such as the widespread use of endpoint detection and response (EDR)
> tools and Microsoft's decision to disable Visual Basic for Applications (VBA)
> macros by default. Consequently, threat actors are exploring new attack
> avenues, with a growing focus on exploiting vulnerabilities in 
> internet-facing systems, most of which run on Linux." 

>  Via BleepingComputer

> ======================================================================
> Link to news story: https://www.techradar.com/pro/security/linux-devices-hit-
> with-even-more-new-ma lware-this-time-from-chinese-hackers

> $$


Another good to read article.
Thanks Mike.
Ed
--- SBBSecho 3.20-Linux
 * Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)

.