https://github.com/timb-machine/linux-malware

Tracking interesting Linux (and UNIX malware). Send PRs

linux-malware

Breach reports

DFIR reports

• https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ - FreakOut
• https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/ - RandomEXX
• https://www.intezer.com/blog/research/a-storm-is-brewing-ipstorm-now-has-linux-malware/ - IPStorm
• https://cujo.com/iot-malware-journals-prometei-linux/ - Promotei
• https://igor-blue.github.io/2021/03/24/apt1.html
• https://www.sentinelone.com/blog/darkradiation-abusing-bash-for-linux-and-docker-container-ransomware/ - DarkRadiation
• https://www.trendmicro.com/en_gb/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html - DarkRadation
• https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/ - RotaJakiro
• https://blogs.blackberry.com/en/2020/06/threat-spotlight-tycoon-ransomware-targets-education-and-software-sectors - Tycoon
• https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/ - QNAPCrypt
• https://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/ - KillDisk
• https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version - REvil
• https://twitter.com/malwrhunterteam/status/1415403132230803460 - HelloKitty
• https://labs.sentinelone.com/hellokitty-ransomware-lacks-stealth-but-still-strikes-home/ - HelloKitty
• https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf - WINNTI
• https://github.com/fboldewin/FastCashMalwareDissected/blob/master/Operation%20Fast%20Cash%20-%20Hidden%20Cobra%E2%80%98s%20AIX%20PowerPC%20malware%20dissected.pdf - FastCash #aix
• https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - LaZagne
• https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
• https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ - Turian
• https://www.intezer.com/blog/malware-analysis/evilgnome-rare-malware-spying-on-linux-desktop-users/ - EvilGnome
• https://unit42.paloaltonetworks.com/watchdog-cryptojacking/ - WatchDog
• https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/ - RedXOR
• https://vms.drweb.com/virus/?_is=1&i=15389228 - ?
• https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/ - TeamTNT
• https://twitter.com/_larry0/status/1143532888538984448 - Silex
• https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/ - GodLua
• https://blog.talosintelligence.com/2018/05/VPNFilter.html - VPNFilter
• https://blog.talosintelligence.com/2018/06/vpnfilter-update.html - VPNFilter
• https://www.trendmicro.com/en_gb/research/19/f/cryptocurrency-mining-botnet-arrives-through-adb-and-spreads-through-ssh.html - CoinMiner
• https://www.microsoft.com/security/blog/2021/07/22/when-coin-miners-evolve-part-1-exposing-lemonduck-and-lemoncat-modern-mining-malware-infrastructure/ - LemonDuck
• https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-exploited-to-attack-gaming-servers/ - Gafgyt
• https://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html - Mirai
• https://news.sophos.com/en-us/2020/12/16/systembc/ - SystemBC
• https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html - Slapstick #solaris

Supply chain attacks

• https://www.webmin.com/exploit.html - Webmin
• ? - ProFTPd
• ? - UnrealIRCd
• ? - Horde Webmail
• ? - PHPMyAdmin
• ? - PHP
• ? - VsFTPd
• https://portswigger.net/daily-swig/homebrew-bug-allowed-researcher-full-access-to-github-repos - Homebrew

Press/academia

• https://en.wikipedia.org/wiki/Linux_malware - DarkSide
• https://en.wikipedia.org/wiki/Mirai_(malware) - Mirai
• https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/
• https://ieeexplore.ieee.org/document/8418602
• https://gist.github.com/vlamer/2c2ec2ca80a84ab21a32
• http://s3.eurecom.fr/~invano/slides/recon18_linux_malware.pdf
• https://malpedia.caad.fkie.fraunhofer.de/
• https://rp.os3.nl/

Malware samples

• https://bazaar.abuse.ch/browse.php?search=tag%3Aelf
• https://github.com/MalwareSamples/Linux-Malware-Samples
• https://twitter.com/nunohaien/status/1261281420791742464
• https://www.virustotal.com/gui/file/c69ee0f12a900adc654d93aef9ad23ea56bdfae8513e534e1a11dca6666d10aa/detection
• https://github.com/0x27/linux.mirai - Mirai
• https://bazaar.abuse.ch/browse/signature/Mirai/ - Mirai
• https://bazaar.abuse.ch/browse/signature/Gafgyt/ - Gafgyt
• https://bazaar.abuse.ch/browse/signature/XorDDoS/ - XorDDoS
• https://bazaar.abuse.ch/browse/signature/SystemBC/ - SystemBC

Research, PoCs and techniques

Not necessarily malicious code (see Linikatz and unix-privesc-check =)) but interesting capabilities...

• https://tmpout.sh/1/
• https://n0.lol/
• https://vxug.fakedoma.in/papers.html
• https://github.com/willshiao/node-bash-obfuscate
• https://github.com/AlessandroZ/LaZagne
• https://github.com/CiscoCXSecurity/linikatz
• https://github.com/ciscocxsecurity/unix-privesc-check
• https://github.com/rebootuser/LinEnum
• https://www.tarlogic.com/blog/how-to-attack-kerberos/
• https://github.com/CiscoCXSecurity/linikatz/issues
• https://www.first.org/resources/papers/telaviv2019/Rezilion-Shlomi-Butnaro-Beyond-Whitelisting-Fileless-Attacks-Against-L....pdf
• https://gist.github.com/timb-machine/7bd75479ee29aee8762952ea16908eb0
• https://rp.os3.nl/2016-2017/p59/report.pdf
• https://rp.os3.nl/2016-2017/p59/presentation.pdf
• https://rp.os3.nl/2016-2017/p97/report.pdf
• https://rp.os3.nl/2016-2017/p97/presentation.pdf
• https://github.com/rek7/fireELF
• https://github.com/alichtman/malware-techniques
• https://github.com/ripmeep/memory-injector
• https://github.com/zMarch/Orc
• https://github.com/TH3xACE/SUDO_KILLER
• https://github.com/CiscoCXSecurity/sudo-parser
• https://security.humanativaspa.it/openssh-ssh-agent-shielded-private-key-extraction-x86_64-linux/
• http://www.nth-dimension.org.uk/downloads.php?id=77
• https://labs.portcullis.co.uk/presentations/breaking-the-links-exploiting-the-linker/
• https://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/
• https://github.com/NetDirect/nfsshell

Sandboxes

• https://github.com/monnappa22/Limon
• https://bazaar.abuse.ch/
• https://www.virustotal.com/gui/
• https://www.rfxn.com/projects/linux-malware-detect/