Symbiote, discovered by Blackberry researchers, is a new Linux malware designed to infect all running processes on infected machines. The malware is capable of stealing account credentials and providing backdoor access to its operators. A Look into Symbiote Linux Malware…
Security researchers discovered a new ransomware family that targets Linux systems. Called Cheerscrypt, the ransomware targets VMware ESXi servers. It is noteworthy that last year two vulnerabilities in the VMWare ESXi product were included in the attacks of at least…
Microsoft discovered several vulnerabilities affecting Linux desktop computers. The vulnerabilities, collectively dubbed Nimbuspwn, can be chained together to achieve elevation of privileges and subsequently execute various malicious payloads, such as a root backdoor, via remote arbitrary root code execution. Identified…
Security researcher Nick Gregory recently discovered and reported a new Linux kernel vulnerability. Tracked as CVE-2022-25636, the issue impacts Linux kernel versions 5.4 through 5.6.10. The vulnerability is triggered by a heap-of-bounds write in the Netfilter subcomponent of the kernel,…
A new dangerous Linux vulnerability is lurking in unpatched distributions. Called Dirty Pipe and tracked as CVE-2022-0847, the vulnerability is located in the kernel (since version 5.8), creating the possibility for threat actors to overwrite arbitrary data into any read-online…
A new high-severity Linux kernel vulnerability could have been abused to escape a container in order to execute arbitrary commands on the host. The vulnerability is tracked as CVE-2022-0492, and has been detailed by Palo Alto Unit 42 Networks researchers.…
A new Linux wormable botnet has been observed in the wild. Called Abcbot, the threat is targeting “relatively new cloud service providers (CPSs) with cryptocurrency-mining malware and cryptojacking attacks,” according to Trend Micro’s findings. The malware deploys code that removes…
CVE-2021-43267 is a newly disclosed security vulnerability in the Linux Kernel’s Transparent Inter Process Communication (TIPC). The flaw can be exploited both locally and remotely, allowing for arbitrary code execution within the kernel. The result of this would be taking…
Security researchers have uncovered a new, previously unseen malware family targeting Linux systems. Dubbed FontOnLake by ESET researchers, and HCRootkit by Avast and Lacework, the malware has rootkit capabilities, advanced design and low prevalence, suggesting that it is primarily meant…
One of the latest discoveries in the Linux security field reveals that the Windows Subsystem for Linux, shortly known as WSL, has turned into a new attack surface. Security researchers recently came across a number of malicious files written primarily…
Four security vulnerabilities, recently addressed in Microsoft Windows Patch Tuesday for September, could allow attackers to target Azure cloud customers. The flaws could enable escalation of privilege and remote takeover attacks on exposed systems. Related: Linux Threat Landscape 2021: Most…
What are the threats endangering Linux systems? Security researchers from Trend Micro just released a report focused on the “pressing security issues including malware and vulnerabilities that compromise Linux systems in the first half of 2021.” Related: The Facefish Operation:…
DarkRadiation is a new ransomware that targets Linux and Docker cloud containers. Coded in Bash, the ransomware targets specifically Red Hat/CentOS and Debian Linux distributions, according to Trend Micro’s research. Related: Previously Undetected RotaJakiro Malware Targets Linux X64 Systems For…
Security researchers recently discovered a vulnerability in Linux systemd’s polkit. Identified as CVE-2021-3560, the flaw appears to have been around for at least seven years. Since polkit is used in many Linux distributions, the impact of the vulnerability should not…
The Linux ecosystem is endangered by a new type of a backdoor with rootkit capabilities. The new malware is also capable of stealing information from the system, such as user credentials and device details, and executing arbitrary commands. Facefish: New…
A sample of Linux malware has been circling the web for at least three years without being detected. The discovery comes from security firm Qihoo 360 NETLAB. “On March 25, 2021, 360 NETLAB’s BotMon system flagged a suspiciousELF file with…
A dangerous Linux malware called Drovorub has been recently discovered to be an espionage tool used by Russian hackers in attack campaigns. Recent news about it reveals that the scope of the intrusions might be particularly high-impact. Details about it…
BootHole is a new vulnerability in the GRUB2 bootloader used by most Linux distributions. The vulnerability, CVE-2020-10713, can be exploited for arbitrary code execution during the boot process, even with Secure Boot enabled. If exploited successfully, the vulnerability could give…
Security researchers at Kaspersky Labs recently detected a new malware framework that they called MATA. The researchers believe the MATA framework is linked to the Lazarus APT group. The MATA framework contains several components, including loader, orchestrator, and plugins, and…
A new strain of IoT malware, dubbed Kaiji, was just discovered by security researchers MalwareMustDie and Intezer Labs. The new IoT malware is built to target Linux-based servers and connected devices to launch DDoS attacks, and was coded by Chinese…
