Cyber Security Threat Summary:
Fresh Linux malware variations are being utilized by hackers in cyber espionage attacks, including a novel PingPull version and an undocumented backdoor known as Sword2033. Last year, PingPull was initially observed as a RAT ( remote access trojan) in espionage operations by the Chinese state-sponsored group, Gallium or Alloy Taurus, targeting government and financial institutions in Australia, Russia, Belgium, Malaysia, Vietnam and the Philippines. Unit 42 has been monitoring these espionage campaigns and recently disclosed that the Chinese threat actor has been using new malware versions to target South Africa and Nepal.

Currently, only three out of 62 anti-virus vendors can identify the Linux version of PingPull, which is an ELF file that is malicious. Unit 42 discovered that it is a port of the well-known Windows malware by identiifying the resemblances in its HTTP communication structure, POST parameters, AES key, an dthe commands it obtains from the threat actor's C2 server.

“The commands the C2 sends to the malware are indicated by a single uppercase character in the HTTP parameter, and the payload returns the results to the server via a base64-encoded request.

The parameters and corresponding commands are: