Security News > 2021 > November > New CronRAT malware infects Linux systems using odd day cron jobs

Security researchers have discovered a new remote access trojan for Linux that keeps an almost invisible profile by hiding in tasks scheduled for execution on a non-existent day, February 31st. Dubbed CronRAT, the malware is currently targeting web stores and enables attackers to steal credit card data by deploying online payment skimmers on Linux servers.

CronRAT abuses the Linux task scheduling system, cron, which allows scheduling tasks to run on non-existent days of the calendar, such as February 31st. The Linux cron system accepts date specifications as long as they have a valid format, even if the day does not exist in the calendar - which means that the scheduled task won't execute.

"The CronRAT adds a number of tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid, but would generate a run time error when executed. However, this will never happen as they are scheduled to run on February 31st," Sansec Researchers explain.

The researchers note that the malware contacts a command and control server using an "Exotic feature of the Linux kernel that enables TCP communication via a file."

At the end of these exchanges, the attackers behind CronRAT can run any command on the compromised system.

CronRAT has been found on multiple stores across the world, where it was used to inject on the server scripts that steal payment card data - the so-called Magecart attacks.

News URL

https://www.bleepingcomputer.com/news/security/new-cronrat-malware-infects-linux-systems-using-odd-day-cron-jobs/