This sneaky Linux malware has been operating under the radar for years
RotaJakiro malware takes great pains to fly under the radar
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Security researchers have recently flagged abackdoor malwarethat targets 64-bitLinux installations. However the researchers report that the malware has evaded detection for at least three years.
Analysis of the backdoor, named RotaJakiro by researchers atQihoo 360’s Network Security Research Lab (360 Netlab), revealed that it enables attackers to harvest and exfiltrate sensitive information from compromised devices.
BleepingComputerreports that the malware isn’t picked up by VirusTotal’s anti-malware engines, despite the fact that a sample was first uploaded to its database in 2018.
We’re looking at how our readers use VPN for a forthcoming in-depth report. We’d love to hear your thoughts in the survey below. It won’t take more than 60 seconds of your time.
Click here to start the survey in a new window«
The 360 Netlab researchers say that the malware uses the ROTATEencryptionalgorithm and has different profiles that it employs depending on whether its executing on a root or a non-root account.
Once it’s made itself home, it establishes communication with the command and control (C&C) server and awaits instructions.
Stealthy operator
The researchers note that RotaJakiro takes several steps to ensure it stays under the radar, including compressing and encrypting its communication channels using ZLIB, AES, XOR, ROTATE algorithms.
Breaking down the malware further reveals that RotaJakiro has several functional similarities with theTorii Botnet, which was exposed by security researchers atAvastback in 2018.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
More worryingly however, the 360 Netlab researchers are clueless as to the true intent of the threat actors behind the malware.
“RotaJakiro supports a total of 12 functions, three of which are related to the execution of specific Plugins. Unfortunately, we have no visibility to the plugins, and therefore do not know its true purpose,” admit the researchers.
They believe their analysis is just the “tip of the iceberg” and the malware will remain a threat until they uncover its true intentions and how it managed to spread.
ViaBleepingComputer
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Scotland vs South Africa live stream: how to watch 2024 rugby union Autumn International online from anywhere
