New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

Scientists have unearthed a discovery that doesn’t arise all that usually in the realm of malware: a mature, never-ahead of-observed Linux backdoor that employs novel evasion strategies to conceal its existence on contaminated servers, in some cases even with a forensic investigation.

On Thursday, scientists from Intezer and The BlackBerry Threat Investigation & Intelligence Crew claimed that the beforehand undetected backdoor combines large levels of obtain with the skill to scrub any signal of an infection from the file technique, program procedures, and network website traffic. Dubbed Symbiote, it targets monetary institutions in Brazil and was very first detected in November.

Scientists for Intezer and BlackBerry wrote:

What makes Symbiote unique from other Linux malware that we commonly occur across, is that it requirements to infect other running procedures to inflict destruction on infected devices. Instead of staying a standalone executable file that is run to infect a device, it is a shared object (SO) library that is loaded into all managing processes utilizing LD_PRELOAD (T1574.006), and parasitically infects the device. Once it has contaminated all the working procedures, it delivers the risk actor with rootkit operation, the capacity to harvest qualifications, and remote entry capability.

With the help of LD_PRELOAD, Symbiote will load prior to any other shared objects. That permits the malware to tamper with other library information loaded for an software. The picture underneath reveals a summary of all of the malware’s evasion tactics.

BPF in the graphic refers to the Berkeley Packet Filter, which makes it possible for people to conceal malicious community site visitors on an infected device.

“When an administrator starts any packet seize tool on the contaminated machine, BPF bytecode is injected into the kernel that defines which packets must be captured,” the scientists wrote. “In this process, Symbiote provides its bytecode to start with so it can filter out network targeted visitors that it does not want the packet-capturing software package to see.”

One particular of the stealth strategies Symbiote employs is identified as libc functionality hooking. But the malware also uses hooking in its function as a facts-theft resource. “The credential harvesting is executed by hooking the libc read operate,” the researchers wrote. “If an ssh or scp approach is contacting the purpose, it captures the qualifications.”

So considerably, there’s no proof of infections in the wild, only malware samples found on line. It is unlikely this malware is greatly active at the moment, but with stealth this strong, how can we be absolutely sure?