Sophisticated Quasar Linux RAT Targets Software Developers
A recently identified Linux backdoor was designed to steal developer credentials across the software supply chain, Trend Micro warns.
Dubbed Quasar Linux (QLNX), the RAT has a modular architecture, uses multiple persistence and detection evasion mechanisms, packs a rootkit, and provides attackers with remote access to the infected machines.
The main purpose of QLNX, Trend Micro says, is the theft of developer credentials, keys, and tokens that could provide its operators with access to development tools, cloud environments, and repositories.
It targets AWS credentials and configurations, Kubernetes tokens, Docker Hub credentials, Git access tokens and configurations, NPM authentication tokens, and PyPI API keys, potentially allowing operators to publish malicious packages through established developer accounts.
“An attacker who successfully deploys QLNX against a package maintainer gains access to that maintainer’s publishing pipeline. A single compromise can be silently leveraged to trojanize packages, inject backdoors into build artifacts, or pivot into...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
