Security News > 2023 > March > Iron Tiger hackers create Linux version of their custom malware
The APT27 hacking group, aka "Iron Tiger," has prepared a new Linux version of its SysUpdate custom remote access malware, allowing the Chinese cyberespionage group to target more services used in the enterprise.
According to a new report by Trend Micro, the hackers first tested the Linux version in July 2022.
The new malware variant is written in C++ using the Asio library, and its functionality is very similar to Iron Tiger's Windows version of SysUpdate.
Trend Micro comments that Iron Tiger used a Wazuh-signed executable in later sideloading stages to blend with the victim's environment, as the target organization used the legitimate Wazuh platform.
One new feature in the Linux SysUpdate variant is DNS tunneling, seen only on one Windows sample of the malware.
Trend Micro says the choice of the Asio library for developing the Linux version of SysUpdate might be due to its multi-platform portability and predicts that a macOS version of the malware might appear in the wild soon.
News URL
Related news
- Chinese hackers target Linux with new WolfsBane malware (source)
- North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS (source)
- North Korean hackers use new macOS malware against crypto firms (source)
- New CRON#TRAP Malware Infects Windows by Hiding in Linux VM to Evade Antivirus (source)
- Unpatched Mazda Connect bugs let hackers install persistent malware (source)
- North Korean Hackers Target macOS Using Flutter-Embedded Malware (source)
- Iranian Hackers Use "Dream Job" Lures to Deploy SnailResin Malware in Aerospace Attacks (source)
- Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails (source)
- Iranian Hackers Deploy WezRat Malware in Attacks Targeting Israeli Organizations (source)
- Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia (source)