Intezer found the Linux malware on VirusTotal and provides detailed analysis. Capabilities include both passive and active communications with the threat actor. Unfortunately, they were only able to obtain parts of the framework. The researchers are missing important information from a live infection. Such a real-life infection could provide the malleable C2 configuration profiles, which could potentially provide additional IOCs. BleepingComputer quotes Intezer’s Ryan Robinson noting that it is not common to see such a large framework developed for targeting Linux. The same report adds that the malware has not been spotted in the wild yet. Malwarebytes points out that the boot script typosquats Elasticsearch as “elastisearch” and carries a forged timestamp, so a hasty investigator would date it to the initial system setup.
