K
Kathleen Martin
Guest
A new piece of stealthy Linux malware called Shikitega has been uncovered adopting a multi-stage infection chain to compromise endpoints and IoT devices and deposit additional payloads.
"An attacker can gain full control of the system, in addition to the cryptocurrency miner that will be executed and set to persist," AT&T Alien Labs said in a new report published Tuesday.
The findings add to a growing list of Linux malware that has been found in the wild in recent months, including BPFDoor, Symbiote, Syslogk, OrBit, and Lightning Framework.
Once deployed on a targeted host, the attack chain downloads and executes the Metasploit's "Mettle" meterpreter to maximize control, exploits vulnerabilities to elevate its privileges, adds persistence on the host via crontab, and ultimately launches a cryptocurrency miner on infected devices.
The exact method by which the initial compromise is achieved remains unknown as yet, but what makes Shikitega evasive is its ability to download next-stage payloads from a command-and-control (C2) server and execute them directly in memory.
Privilege escalation is achieved by means of exploiting CVE-2021-4034 (aka PwnKit) and CVE-2021-3493, enabling the adversary to abuse the elevated permissions to fetch and execute the final stage shell scripts with root privileges to establish persistence and deploy the Monero crypto miner.
Continue reading: https://thehackernews.com/2022/09/new-stealthy-shikitega-malware.html
"An attacker can gain full control of the system, in addition to the cryptocurrency miner that will be executed and set to persist," AT&T Alien Labs said in a new report published Tuesday.
The findings add to a growing list of Linux malware that has been found in the wild in recent months, including BPFDoor, Symbiote, Syslogk, OrBit, and Lightning Framework.
Once deployed on a targeted host, the attack chain downloads and executes the Metasploit's "Mettle" meterpreter to maximize control, exploits vulnerabilities to elevate its privileges, adds persistence on the host via crontab, and ultimately launches a cryptocurrency miner on infected devices.
The exact method by which the initial compromise is achieved remains unknown as yet, but what makes Shikitega evasive is its ability to download next-stage payloads from a command-and-control (C2) server and execute them directly in memory.
Privilege escalation is achieved by means of exploiting CVE-2021-4034 (aka PwnKit) and CVE-2021-3493, enabling the adversary to abuse the elevated permissions to fetch and execute the final stage shell scripts with root privileges to establish persistence and deploy the Monero crypto miner.
Continue reading: https://thehackernews.com/2022/09/new-stealthy-shikitega-malware.html
