New Quasar Linux Malware Is Stealing Developer Credentials with a Hidden Rootkit
Researchers at Trend Micro have identified a frightening new Linux rootkit, dubbed Quasar Linux (QLNX,) and developers should be especially concerned. Per the report (which we spotted through Bleeping Computer's coverage,) QLNX is a Linux implant "designed for stealth and long-term persistence" that hides in memory and uses seven distinct persistence mechanisms. When combined, its persistence mechanisms make it difficult to actually "kill" QLNX, since any one of the seven can restart the process the instant it stops running.
Beyond stealth and persistence functionality, QLNX is also a dangerous, multi-faceted piece of malware. Process injection, peer-to-peer-networking, surveillance functionalities, credential harvesting, and filesystem monitoring are all within QLNX's capabilities. Since it's primarily being targeted at development environments (particularly across GitHub, AWS, Kubernetes, and more,) the intent seems to be to integrate QLNX into otherwise innocent apps and server hosts and perform supply-chain attacks by publishing malicious packages. We've seen that...
Copyright of this story solely belongs to hothardware.com. To see the full text click HERE
