Security News > 2023 > March > Iron Tiger hackers create Linux version of their custom malware
The APT27 hacking group, aka "Iron Tiger," has prepared a new Linux version of its SysUpdate custom remote access malware, allowing the Chinese cyberespionage group to target more services used in the enterprise.
According to a new report by Trend Micro, the hackers first tested the Linux version in July 2022.
The new malware variant is written in C++ using the Asio library, and its functionality is very similar to Iron Tiger's Windows version of SysUpdate.
Trend Micro comments that Iron Tiger used a Wazuh-signed executable in later sideloading stages to blend with the victim's environment, as the target organization used the legitimate Wazuh platform.
One new feature in the Linux SysUpdate variant is DNS tunneling, seen only on one Windows sample of the malware.
Trend Micro says the choice of the Asio library for developing the Linux version of SysUpdate might be due to its multi-platform portability and predicts that a macOS version of the malware might appear in the wild soon.
News URL
Related news
- Chinese hackers target Linux with new WolfsBane malware (source)
- FIN7 hackers launch deepfake nude “generator” sites to spread malware (source)
- New Perfctl Malware Targets Linux Servers for Cryptocurrency Mining and Proxyjacking (source)
- Linux malware “perfctl” behind years-long cryptomining campaign (source)
- Linux systems targeted with stealthy “Perfctl” cryptomining malware (source)
- N. Korean Hackers Use Fake Interviews to Infect Developers with Cross-Platform Malware (source)
- New FASTCash malware Linux variant helps steal money from ATMs (source)
- New Linux Variant of FASTCash Malware Targets Payment Switches in ATM Heists (source)
- North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS (source)
- North Korean hackers use new macOS malware against crypto firms (source)