ESET discovers Linux malware that steals data via infected OpenSSH client

Security researchers at ESET have found a new malware targeting Linux specifically. It is a targeted malware that opens a backdoor by stealing credentials via an infected OpenSSH download.

Security firm ESET calls the malware Kobalos. That would affect, among other things, Linux distros, and the operating systems BSD and Solaris. The company speculates that the malware may also be active on Windows, but it has no evidence of that. The company found victims of the malware all over the world. The affected systems are supercomputers and servers in mainly academic and research institutions, but it is not clear what the attackers were looking for.

The researchers call the malware advanced. It would have many options to hide itself on a system and to evade detection. There would be multiple ways to contact the malware. One of those ways is to open a tcp port, which creates an encrypted connection. A key is generated locally for this, which according to the discoverers is striking because the malware is actually very small.

It is unclear what exactly the malware is trying to achieve. Once installed on a system, an OpenSSH client is installed that steals users’ credentials, which the attackers can then use to execute commands on the system. Interestingly, the researchers saw references to old code that applied to Windows 95. That doesn’t mean the malware is that old; parts from older malwares may have been used here and there.