Stealthy OrBit Malware Steals Data From Linux Devices

Share post:

A newly detected Linux malware is being used to covertly steal information from backdoored Linux systems and infect all running processes on the network.

Intezer Labs security researchers, who first spotted the malware, named it OrBit. OrBit hijacks shared libraries to seize function calls by modifying the LD_PRELOAD environment variable on compromised devices.

While it can achieve persistence via two different methods to stop removal attempts, OrBit may also be deployed as a volatile implant when copied in shim-memory.

It can also hook some functions to evade detection, manipulate process behavior, maintain persistence by infecting new processes, and conceal network activity that would expose its presence.

For example, the moment it injects into a running process, OrBit can control its output to conceal any traces of its existence by filtering out what is logged.

“The malware implements advanced evasion techniques and gains persistence on the machine by hooking key functions, provides the threat actors with remote access capabilities over SSH, harvests credentials, and logs TTY commands. Once the malware is installed it will infect all of the running processes, including new processes, that are running on the machine,” explained Intezer Labs security researcher Nicole Fishbein.

Incidentally, OrBit is not the first highly-evasive Linux malware to come out recently that is capable of using identical methods to totally compromise and backdoor devices.

Symbiote also utilizes the LD_PRELOAD directive to load itself into running processes, rendering itself as a system-wide parasite without any traces of infection.

BPFDoor, another recently detected malware targeting Linux systems, disguises itself by using the names of common Linux daemons, which helps it in remaining undetected for five years or even more.

Both these strains use BPF (Berkeley Packet Filter) hooking functionality to monitor and control network traffic, thus helping hide their communication channels from security tools.

For more information, read the original story in Bleeping Computer.

SUBSCRIBE NOW

Related articles

DOGE’s Teen Hacker Stirs Concern Over Musk Team’s Access to Federal Databases

A 19-year-old named Edward “Big Balls” Coristine has raised red flags after Wired revealed he holds a key...

Deep Seek and Open Source AI – Without the Hype: Discussion with Robert Falzon, Head of Engineering, Check Point

DeepSeek AI is shaking up the cybersecurity world—are we prepared for the risks? Join host Jim Love and...

Researchers Jailbreak DeepSeek AI, Expose System Prompt and Raise Security Concerns

Security researchers at Wallarm have successfully jailbroken DeepSeek, a recently released open-source AI model from China. The jailbreak...

New SMS Phishing Scam Targets U.S. Toll Road Users with Fake Payment Alerts

Brian Krebs of the Krebs on Security blog did a big piece leading with how residents across the...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways