This stealthy Linux malware starts off small but gradually takes control

guest · Sep 7, 2022

by Danny Palmer @dannyjpalmer, Senior Writer - September 7, 2022

A stealthy new form of malware is targeting Linux systems in attacks that can take full control of infected devices – and it is using this access to install crypto-mining malware.

Dubbed Shikitega, the malware targets endpoints and Internet of Things devices that run on Linux operating systems and has been detailed by cybersecurity researchers at AT&T Alien Labs.
Click to expand...

The malware is delivered in a multi-stage infection chain, where each module responds to commands from the previous part of the payload and downloads and executes the next one.

By downloading the payload bit by bit – starting with a module that is just a few hundred bytes – Shikitega can avoid being uncovered by anti-virus software. It also uses a polymorphic encoder to make it more difficult to detect.
Click to expand...

Researchers also note that those behind Shikitega appear to abuse legitimate cloud services to host some of their command-and-control servers.

The initial method of infection is still unknown, but the malware gradually downloads more and more modules to provide full functionality, starting with the initial dropper, then going through several stages – including downloading Mettle, a Metasploit offensive security tool, which allows the attacker to deploy a wide range of attacks.
Click to expand...

AT&T Alien Labs: Shikitega - New stealthy malware targeting Linux

By Ofer Caspi @shablolForce - September 6, 2022
AT&T Alien Labs has discovered a new malware targeting endpoints and IoT devices that are running Linux operating systems. Shikitega is delivered in a multistage infection chain where each module responds to a part of the payload and downloads and executes the next one. An attacker can gain full control of the system, in addition to the cryptocurrency miner that will be executed and set to persist.
Click to expand...

Key takeaways:

The malware downloads and executes the Metasploit’s “Mettle” meterpreter to maximize its control on infected machines.

Shikitega exploits system vulnerabilities to gain high privileges, persist and execute crypto miner.

The malware uses a polymorphic encoder to make it more difficult to detect by anti-virus engines.

Shikitega abuse legitimate cloud services to store some of its command and control servers (C&C).

Click to expand...

summerheat · Sep 7, 2022

Another example of a non-issue if you keep your system up-to date. Excerpt from the first article:

The malware downloads and executes further modules that exploit vulnerabilities in Linux, which can be used to achieve persistence and control of the compromised system.

The vulnerabilities are CVE-2021-3493, a validation issue in the Linux kernel that allows attackers to gain elevated privileges, and CVE-2021-4034, a high-severity memory corruption vulnerability in polkit, which is installed by default in Linux distributions.
Click to expand...

These vulnerabilities were fixed long ago.

Rasheed187 · Sep 8, 2022

summerheat said: ↑

Another example of a non-issue if you keep your system up-to date. These vulnerabilities were fixed long ago.
Click to expand...

I know how you feel, same goes for Windows, most of the reports are non-issues, especially when you're using the right security tools, patch your system and download apps only from trusted sources. Nevertheless, it's still interesting to read these reports, because the malware techniques being used are quite nifty.

Log in or Sign up

This stealthy Linux malware starts off small but gradually takes control

guest Guest

summerheat Registered Member

Rasheed187 Registered Member

Log in or Sign up

This stealthy Linux malware starts off small but gradually takes control

guest Guest

summerheat Registered Member

Rasheed187 Registered Member

Useful Searches