Backdoor trojan targets Linux servers and spreads cryptominer

A recently discovered backdoor Trojan named SpeakUp affects Linux servers and distributes the crypto mining malware XMRig. The trojan can contain any payload and run it on affected machines.

SpeakUp is a new trojan that, according to Check Points latest Global Threat Index, is not yet detected by antivirus software. The malware is distributed through a series of exploits based on commands and control servers, including ‘command injection via http’; a common vulnerability.

The Check Point researchers call SpeakUp a serious threat because Linux is widely used on corporate servers and anti-virus companies are not yet detecting the malware. In January, the four most commonly found malware variants were cryptominers, according to the company. Coinhive remains the top malware impacting 12 percent of organizations worldwide, with Check Point likely relying on detections at its customers.

Open source CPU mining software XMRig, which is distributed by SpeakUp, among others, was again in second place with an impact of eight percent, followed by the Cryptoloot miner with 6 percent.