New ‘Lightning Framework’ Linux malware installs rootkits, backdoors

guest · Jul 21, 2022

July 21, 2022

A new and previously undetected malware dubbed 'Lightning Framework' targets Linux systems and can be used to backdoor infected devices using SSH and deploy multiple types of rootkits.

Described as a "Swiss Army Knife" in a report published today by Intezer, Lightning Framework is a modular malware that also comes with support for plugins.

"The framework has both passive and active capabilities for communication with the threat actor, including opening up SSH on an infected machine, and a polymorphic malleable command and control configuration," Intezer security researcher Ryan Robinson said.
Click to expand...

The malware uses typosquatting and will masquerade as the Seahorse GNOME password and encryption key manager to evade detection on infected systems.

Other methods to hide its presence include altering malicious artifacts' timestamps using timestomping and hiding its Process ID (PID) and any related network ports using one of several rootkits it can deploy.
Last but not least, this malware will also add its own SSH-based backdoor by starting an SSH server using one of the downloaded plugins (Linux.Plugin.Lightning.Sshd).
Click to expand...

"The Lightning Framework is an interesting malware as it is not common to see such a large framework developed for targeting Linux," Robinson concluded.

Lightning Framework is just the latest Linux malware strain capable of fully compromising and backdooring devices that surfaced recently.
Click to expand...

Intezer: Lightning Framework: New Undetected “Swiss Army Knife” Linux Malware

Year after year Linux environments increasingly become the target of malware due to continued threat actor interest in the space. Malware targeting Linux environments surged in 2021, with a large amount of innovation resulting in new malicious code, especially in ransomwares, trojans, and botnets. With the rise in use of the cloud, it is no wonder that malware innovation is still accelerating at breakneck speed in this realm.

This is a technical analysis of a previously undocumented and undetected Linux threat called the Lightning Framework. It is rare to see such an intricate framework developed for targeting Linux systems.
Click to expand...

We have not observed this malware being used in attacks in the wild.
Click to expand...

Log in or Sign up

New ‘Lightning Framework’ Linux malware installs rootkits, backdoors

guest Guest

Log in or Sign up

New ‘Lightning Framework’ Linux malware installs rootkits, backdoors

guest Guest

Useful Searches