Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
101010.pl is one of the many independent Mastodon servers you can use to participate in the fediverse.
101010.pl czyli najstarszy polski serwer Mastodon. Posiadamy wpisy do 2048 znaków.

Administered by:

Server stats:

507
active users

101010.pl: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0-beta.1

#linuxbackdoor

0 posts0 participants0 posts today
ṫẎℭỚ◎ᾔ ṫ◎ℳ<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>briankrebs</span></a></span> Is it true that a <a href="https://infosec.exchange/tags/microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>microsoft</span></a> Dev found the <a href="https://infosec.exchange/tags/LinuxBackdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LinuxBackdoor</span></a> ?🤔</p>
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:​<p>"🚨 Earth Lusca's New Linux Backdoor: SprySOCKS Unveiled! 🐙"</p><p>Earth Lusca, a China-linked threat actor, has been spotted employing a novel Linux backdoor, dubbed "SprySOCKS". This malware seems to have evolved from the open-source Windows backdoor Trochilus. The backdoor showcases swift behavior and a SOCKS implementation, hence the name. 🐍💼</p><p>SprySOCKS's structure is reminiscent of the RedLeaves backdoor, a RAT known to infect Windows machines. This backdoor is still under development, with different versions observed. Its interactive shell seems to draw inspiration from the Linux variant of the Derusbi malware. 🕵️‍♂️🔍</p><p>Recent activities of Earth Lusca indicate a focus on Southeast Asia, Central Asia, and the Balkans. Their primary targets? Government departments in foreign affairs, technology, and telecommunications. They've been exploiting server-based N-day vulnerabilities, including CVE-2022-40684, CVE-2022-39952, and more. Once inside, they deploy Cobalt Strike for lateral movement, aiming to exfiltrate sensitive data and conduct long-term espionage. 🌍🎯</p><p>Source: <a href="https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html" rel="nofollow noopener" target="_blank">Trend Micro Research</a></p><p>Tags: <a href="https://infosec.exchange/tags/EarthLusca" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EarthLusca</span></a> <a href="https://infosec.exchange/tags/SprySOCKS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SprySOCKS</span></a> <a href="https://infosec.exchange/tags/LinuxBackdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LinuxBackdoor</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/APT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APT</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/RedLeaves" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RedLeaves</span></a> <a href="https://infosec.exchange/tags/Trochilus" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Trochilus</span></a> <a href="https://infosec.exchange/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CobaltStrike</span></a> 🌐🔐🖥️</p>
ExploreLive feeds
About