Comment

Comment on Chinese hackers have unleashed a never-before-seen Linux backdoor

autotldr@lemmings.world [bot] ⁨1⁩ ⁨year⁩ ago

This is the best summary I could come up with:

Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass.

In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021.

The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation.

The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component.

Besides showing interest in espionage activities, Earth Lusca seems financially motivated, with sights set on gambling and cryptocurrency companies.

Monday’s Trend Micro report provides IP addresses, file hashes, and other evidence that people can use to determine if they’ve been compromised.

The original article contains 537 words, the summary contains 143 words. Saved 73%. I’m a bot and I’m open source!

source

Sort:hotnew top

MonkderZweite@feddit.ch ⁨1⁩ ⁨year⁩ ago

Ok, but what does it attack. Systemd, udev, fuse, …?

source

sirico@feddit.uk ⁨1⁩ ⁨year⁩ ago

link to another article with the cve’s: trendmicro.com/…/earth-lusca-employs-new-linux-ba…

source

Zeth0s@lemmy.world ⁨1⁩ ⁨year⁩ ago

So it’s not general to every linux distro, is it?

source

sirico@feddit.uk ⁨1⁩ ⁨year⁩ ago

I could be wrong but this is a quick summary as I would look at it. As the Sysop for a small company running linux

Fortinet FortiOS, FortiProxy, and FortiSwitchManager:
Type: Authentication bypass vulnerability
Impact: If you're using any of these Fortinet products, an attacker could bypass authentication mechanisms and potentially access or control the system.
Affect on Linux users: Only those Linux users who have these Fortinet products in their environments would be affected.

CVE-2022-39952:
Product: Fortinet FortiNAC
Type: Unauthenticated remote code execution (RCE)
Impact: Attackers can remotely execute code without authentication.
Affect on Linux users: Relevant for Linux users/administrators who use Fortinet FortiNAC in their network.

CVE-2021-22205:
Product: GitLab CE/EE
Type: Unauthenticated RCE
Impact: An attacker could remotely execute code without authentication on GitLab instances.
Affect on Linux users: This would affect Linux users who host or interact with GitLab CE/EE instances.

CVE-2019-18935:
Product: Progress Telerik UI for ASP.NET AJAX
Type: Unauthenticated RCE
Impact: Allows remote code execution on affected servers using this UI component.
Affect on Linux users: Most Linux users would not be impacted unless they host ASP.NET applications using this specific UI component.

CVE-2019-9670 / CVE-2019-9621:
Product: Zimbra Collaboration Suite
Type: Bundle of two vulnerabilities for unauthenticated RCE
Impact: Attackers can remotely execute code without authentication on systems using Zimbra.
Affect on Linux users: Linux users who use or host the Zimbra Collaboration Suite would be affected.

ProxyShell (CVE-2021-34473, CVE-2021-34523v, CVE-2021-31207):
Product: Microsoft Exchange
Type: Set of three chained vulnerabilities for unauthenticated RCE
Impact: Attackers can exploit these vulnerabilities in sequence to remotely execute code on Exchange servers.
Affect on Linux users: This primarily impacts organizations that run Microsoft Exchange servers. Directly, Linux users wouldn't be affected unless they interact with or administer these servers.

source

-> View More Comments

MonkderZweite@feddit.ch ⁨1⁩ ⁨year⁩ ago
Thanks!

source