APT Groups Set Sights on Linux Targets: Inside the Trend

guest · Sep 12, 2020

APT Groups Set Sights on Linux Targets: Inside the Trend
Researchers see more advanced attack groups creating tools and platforms to target Linux-based devices
September 11, 2020
https://www.darkreading.com/attacks...linux-targets-inside-the-trend/d/d-id/1338898

A steady increase in advanced persistent threat (APT) groups targeting Linux resources has prompted researchers to share the details of these attacks and explain the misconceptions around Linux security, as well as how organizations can better protect their Linux machines.

Kaspersky's Global Research & Analysis Team (GReAT) has observed this steady trend over the last eight years, says researcher Yury Namestnikov, More and more advanced groups are creating tools, and even platforms, to target devices running Linux software, he says.
There is a broadly held opinion that the Linux operating system is secure by default and not susceptible to malicious code.

The implications are dangerous. As a result, information security departments and the security teams at software vendors are less focused on mitigations for this problem, creating a situation in which organizations have less visibility and tools to protect Linux desktops, servers, and IoT.
Click to expand...

"It's not true for all organizations, but unfortunately, it's a common situation in many cases," Namestnikov explains. "And when we start to talk about targeted attacks we can easily see, almost every serious threat actor has some surprise tools for hacking in and getting control over Linux-running machines.

There are many reasons why APT groups target Linux over Windows, he says. A key factor is the trend toward containerization, which has driven Linux adoption.
An Evolving Threat
Attackers have made changes to Linux malware and attacks targeting Linux devices.
Click to expand...

Kaspersky: An overview of targeted attacks and APTs on Linux

The Global Research and Analysis Team (GReAT) at Kaspersky publishes regular summaries of advanced persistent threat (APT) activity, based on the threat intelligence research discussed in greater detail in our private APT reports. In this report, we focus on the targeting of Linux resources by APT threat actors.

Barium [...] Cloud Snooper [...] DarkHotel [...] Equation [...] HackingTeam [...] Lazarus [...]
Sofacy [...] The Dukes [...] The Lamberts [...] Tsunami backdoor [...] Turla [...]
Two-Sail Junk [...] WellMess [...] WildNeutron [...] Zebrocy [...]
Click to expand...

One of the main reasons that Linux systems go unprotected is a false sense of security from using Linux instead of the far more popular (and more targeted) Windows. Nevertheless, we hope all the aforementioned points are convincing enough for you to start securing your Linux-based machines in a serious way.

The very first recommendation is to maintain a list of trusted sources of your software. [...]
Click to expand...

guest · Sep 12, 2020

mood said: ↑

APT Groups Set Sights on Linux Targets: Inside the Trend September 11, 2020

Kaspersky: An overview of targeted attacks and APTs on Linux
Click to expand...

How invulnerable is Linux?
Our experts analyzed sophisticated attacks and APT campaigns targeting Linux, and they provided some security recommendations
September 10, 2020
https://www.kaspersky.com/blog/threats-targeting-linux/37001/

Linux is malware-free — or so many believed for many years. The delusion arose from three bases. First, Linux was a niche system, used far less commonly than Windows. Second, it was used mainly by IT pros, who are savvier than the average user. And third, given the specifics of the system architecture, malware would have to obtain root permissions somehow to cause damage, greatly complicating attacks.

Admittedly, we haven’t seen a single large-scale epidemic affecting Linux-based systems — yet. The masterminds behind targeted and APT attacks are creating ever more tools tailored specifically for this family of operating systems.

Winniti (aka APT41 or Barium), Cloud Snooper, DarkHotel, Equation, Lazarus, Sofacy, The Dukes, The Lamberts, Turla, WildNeutron, and many others all have tools for attacking Linux-based machines. Another developer of tools targeting Linux is HackingTeam, a company that sells software for so-called legal surveillance to governments and law enforcement agencies. It was hacked a few years ago, and some of its know-how ended up in the hands of cybercriminals. For a more detailed description of attacker groups and their tools, see our Securelist blog report.
Click to expand...

Log in or Sign up

APT Groups Set Sights on Linux Targets: Inside the Trend

guest Guest

guest Guest

Log in or Sign up

APT Groups Set Sights on Linux Targets: Inside the Trend

guest Guest

guest Guest

Useful Searches