Security News > 2022 > September > New Stealthy Shikitega Malware Targeting Linux Systems and IoT Devices

A new piece of stealthy Linux malware called Shikitega has been uncovered adopting a multi-stage infection chain to compromise endpoints and IoT devices and deposit additional payloads.

The findings add to a growing list of Linux malware that has been found in the wild in recent months, including BPFDoor, Symbiote, Syslogk, OrBit, and Lightning Framework.

Once deployed on a targeted host, the attack chain downloads and executes the Metasploit's "Mettle" meterpreter to maximize control, exploits vulnerabilities to elevate its privileges, adds persistence on the host via crontab, and ultimately launches a cryptocurrency miner on infected devices.

In a further attempt to fly under the radar, the malware operators employ a "Shikata ga nai" polymorphic encoder to make it more difficult to detect by antivirus engines and abuse legitimate cloud services for C2 functions.

"Threat actors continue to search for ways to deliver malware in new ways to stay under the radar and avoid detection," AT&T Alien Labs researcher Ofer Caspi said.

"Shiketega malware is delivered in a sophisticated way, it uses a polymorphic encoder, and it gradually delivers its payload where each step reveals only part of the total payload.".

News URL

https://thehackernews.com/2022/09/new-stealthy-shikitega-malware.html