Home > Cyber News > HCRootkit (FontOnLake) Rootkit with Advanced Capabilities Targets Linux Systems

HCRootkit (FontOnLake) Rootkit with Advanced Capabilities Targets Linux Systems

HCRootkit (FontOnLake) Rootkit with Advanced Capabilities Targets Linux Systems

Security researchers have uncovered a new, previously unseen malware family targeting Linux systems. Dubbed FontOnLake by ESET researchers, and HCRootkit by Avast and Lacework, the malware has rootkit capabilities, advanced design and low prevalence, suggesting that it is primarily meant for targeted attacks.

Related: Linux Threat Landscape 2021: Most Prevalent Malware and Vulnerabilities

HCRootkit / FontOnLake Rootkit Targeting Linux Systems

According to researchers, the FontOnLake rootkit is continuously being upgraded with new features, meaning that it is in active development. VirusTotal samples of the malware reveal that its first use in the wild dates back to May 2020. It appears that the malware targets entities in Southeast Asia, but other regions may soon be added to its target list.

The malware grants remote access to its operators, and could be used for credential harvesting and as a proxy server.

Lacework Labs recently examined the new malware which was first shared by Avast. The researchers’ analysis is based on Avast’s findings as well as their own research into this new malware family. According to Lacework’s analysis, “the kernel module as pointed out by Avast is the open-source rootkit “Sutersu”. This rootkit has wide kernel version support, as well as supporting multiple architectures including x86, x86_64, and ARM. Sutersu supports file, port, and process hiding, as one would expect from a rootkit. Sutersu also supports functionality beyond process and file hiding in the form of additional modules that are specified during compile time.”

The malware also contains additional modules, including a keylogger, a module that downloads and executes a binary, and an ICMP module to monitor “for specific magic bytes before triggering an event.”

These modules can be used together to trigger the downloading and execution of a binary when a specific ICMP packet is received, but they also can be used independently.

More technical details are available in Lacework’s detailed technical write-up.

In May 2021, Qihoo 360 NETLAB security researchers discovered another unseen rootkit with backdoor capabilities for Linux, and named its dropper Facefish. The backdoor could upload device information, steal user credentials, bounce Shell, and execute arbitrary commands.

Milena Dimitrova

An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim

More Posts

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share