linux-malware
Breach reports
DFIR reports
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ - FreakOut
- https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/ - RandomEXX
- https://www.intezer.com/blog/research/a-storm-is-brewing-ipstorm-now-has-linux-malware/ - IPStorm
- https://cujo.com/iot-malware-journals-prometei-linux/ - Promotei
- https://igor-blue.github.io/2021/03/24/apt1.html
- https://www.sentinelone.com/blog/darkradiation-abusing-bash-for-linux-and-docker-container-ransomware/ - DarkRadiation
- https://www.trendmicro.com/en_gb/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html - DarkRadation
- https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/ - RotaJakiro
- https://blogs.blackberry.com/en/2020/06/threat-spotlight-tycoon-ransomware-targets-education-and-software-sectors - Tycoon
- https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/ - QNAPCrypt
- https://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/ - KillDisk
- https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version - REvil
- https://twitter.com/malwrhunterteam/status/1415403132230803460 - HelloKitty
- https://labs.sentinelone.com/hellokitty-ransomware-lacks-stealth-but-still-strikes-home/ - HelloKitty
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf - WINNTI
- https://github.com/fboldewin/FastCashMalwareDissected/blob/master/Operation%20Fast%20Cash%20-%20Hidden%20Cobra%E2%80%98s%20AIX%20PowerPC%20malware%20dissected.pdf - FastCash #aix
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - LaZagne
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ - Turian
- https://www.intezer.com/blog/malware-analysis/evilgnome-rare-malware-spying-on-linux-desktop-users/ - EvilGnome
- https://unit42.paloaltonetworks.com/watchdog-cryptojacking/ - WatchDog
- https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/ - RedXOR
- https://vms.drweb.com/virus/?_is=1&i=15389228 - ?
- https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/ - TeamTNT
- https://twitter.com/_larry0/status/1143532888538984448 - Silex
- https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/ - GodLua
- https://blog.talosintelligence.com/2018/05/VPNFilter.html - VPNFilter
- https://blog.talosintelligence.com/2018/06/vpnfilter-update.html - VPNFilter
- https://www.trendmicro.com/en_gb/research/19/f/cryptocurrency-mining-botnet-arrives-through-adb-and-spreads-through-ssh.html - CoinMiner
- https://www.microsoft.com/security/blog/2021/07/22/when-coin-miners-evolve-part-1-exposing-lemonduck-and-lemoncat-modern-mining-malware-infrastructure/ - LemonDuck
- https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-exploited-to-attack-gaming-servers/ - Gafgyt
- https://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html - Mirai
- https://news.sophos.com/en-us/2020/12/16/systembc/ - SystemBC
- https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html - Slapstick #solaris
- https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF - Drovorub
- https://www.welivesecurity.com/2015/04/29/unboxing-linuxmumblehard-muttering-spam-servers/ - Mumblehard
Supply chain attacks
- https://www.webmin.com/exploit.html - Webmin
- ? - ProFTPd
- ? - UnrealIRCd
- ? - Horde Webmail
- ? - PHPMyAdmin
- ? - PHP
- ? - VsFTPd
- https://portswigger.net/daily-swig/homebrew-bug-allowed-researcher-full-access-to-github-repos - Homebrew
Press/academia
- https://en.wikipedia.org/wiki/Linux_malware - DarkSide
- https://en.wikipedia.org/wiki/Mirai_(malware) - Mirai
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/
- https://ieeexplore.ieee.org/document/8418602
- https://gist.github.com/vlamer/2c2ec2ca80a84ab21a32
- http://s3.eurecom.fr/~invano/slides/recon18_linux_malware.pdf
- https://reyammer.io/publications/2018_oakland_linuxmalware.pdf
- https://malpedia.caad.fkie.fraunhofer.de/
- https://rp.os3.nl/
- https://wikileaks.org/vault7/
Malware samples
- https://bazaar.abuse.ch/browse.php?search=tag%3Aelf
- https://github.com/MalwareSamples/Linux-Malware-Samples
- https://twitter.com/nunohaien/status/1261281420791742464
- https://www.virustotal.com/gui/file/c69ee0f12a900adc654d93aef9ad23ea56bdfae8513e534e1a11dca6666d10aa/detection
- https://github.com/0x27/linux.mirai - Mirai
- https://bazaar.abuse.ch/browse/signature/Mirai/ - Mirai
- https://bazaar.abuse.ch/browse/signature/Gafgyt/ - Gafgyt
- https://bazaar.abuse.ch/browse/signature/XorDDoS/ - XorDDoS
- https://bazaar.abuse.ch/browse/signature/SystemBC/ - SystemBC
Research, PoCs and techniques
Not necessarily malicious code (see Linikatz and unix-privesc-check =)) but interesting capabilities...
- https://tmpout.sh/1/
- https://n0.lol/
- https://vxug.fakedoma.in/papers.html
- https://github.com/willshiao/node-bash-obfuscate
- https://github.com/AlessandroZ/LaZagne
- https://github.com/CiscoCXSecurity/linikatz
- https://github.com/ciscocxsecurity/unix-privesc-check
- https://github.com/rebootuser/LinEnum
- https://www.tarlogic.com/blog/how-to-attack-kerberos/
- https://github.com/CiscoCXSecurity/linikatz/issues
- https://www.first.org/resources/papers/telaviv2019/Rezilion-Shlomi-Butnaro-Beyond-Whitelisting-Fileless-Attacks-Against-L....pdf
- https://gist.github.com/timb-machine/7bd75479ee29aee8762952ea16908eb0
- https://rp.os3.nl/2016-2017/p59/report.pdf
- https://rp.os3.nl/2016-2017/p59/presentation.pdf
- https://rp.os3.nl/2016-2017/p97/report.pdf
- https://rp.os3.nl/2016-2017/p97/presentation.pdf
- https://github.com/rek7/fireELF
- https://github.com/alichtman/malware-techniques
- https://github.com/ripmeep/memory-injector
- https://github.com/zMarch/Orc
- https://github.com/TH3xACE/SUDO_KILLER
- https://github.com/CiscoCXSecurity/sudo-parser
- https://security.humanativaspa.it/openssh-ssh-agent-shielded-private-key-extraction-x86_64-linux/
- http://www.nth-dimension.org.uk/downloads.php?id=77
- https://labs.portcullis.co.uk/presentations/breaking-the-links-exploiting-the-linker/
- https://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/
- https://github.com/NetDirect/nfsshell