Scientists Warn of FontOnLake Rootkit Malware Targeting Linux Components – The Hacker Story

Cybersecurity researchers have detailed a new campaign that likely targets entities in Southeast Asia with a previously unrecognized Linux malware that’s engineered to enable remote access to its operators, in addition to amassing credentials and function as a proxy server.

The malware family, dubbed ” FontOnLake ” by Slovak cybersecurity firm ESET, is said to feature “well-designed modules” that are continuously being upgraded with new features, indicating an active development phase. Samples uploaded to VirusTotal point to the possibility that the very first intrusions utilizing this threat have been happening as early as May 2020.

Avast and Lacework Labs are tracking the same malware under the moniker HCRootkit.

“The sneaky nature of FontOnLake’s tools in combination with advanced design and low prevalence suggest that they are used in targeted attacks,” ESET researcher Vladislav Hrčka said . “To collect data or conduct other malicious activity, this malware family uses modified legitimate binaries that are adjusted to load further components. In fact, to conceal its existence, FontOnLake’s presence is always accompanied by a rootkit. These binaries are commonly used on Linux systems and can additionally serve as a persistence mechanism.”

FontOnLake’s toolset includes three components that consist of trojanized versions of legitimate Linux utilities that are used to load kernel-mode rootkits and user-mode backdoors, all of which communicate with one another using virtual files. The C++-based implants themselves are designed to monitor systems, secretly execute commands on networks, and exfiltrate account credentials.

A second permutation of the backdoor also distinction capabilities to act as a proxy server, manipulate files, download human judgements files, while a third type, besides incorporating features for the other two backdoors, typically is equipped to execute Python scripts and shell directions.

ESET talked about it found two specific versions of the Linux rootkit that’s based on an open-source project called Suterusu and publish overlaps in functionality, especially hiding processes, files, mobile phone network connections, and itself, while you are also being able to carry out content operations, and extract on top of that execute the user-mode backdoor.

It’s currently not known how the attackers gain main access to the network, women and men cybersecurity company noted the threat actor behind finally, the attacks is “overly cautious” to avoid leaving any roads by relying on different, uncommon command-and-control (C2) servers using varying non-standard ports. 1 of the C2 servers observed in a VirusTotal artifacts are no longer stimulated.

“Their dimensions and advanced design declare that the authors are well competent in cybersecurity and that they might be reused in future promotions, ” Hrčka said. “As most of the features are designed couple hide its presence, pass on communication, and provide backdoor a way in, we believe that these tools are widely-used mostly to maintain an structure which serves some other, unidentified, malicious purposes. ”

Source of this news: https://thehackernews.com/2021/10/researchers-warn-of-fontonlake-rootkit.html