Summary:
A new variant of the Bifrost remote access Trojan (RAT) has emerged, specifically targeting Linux systems. This variant employs a sophisticated evasion technique by utilizing a deceptive domain, download.vmfare[.]com, which closely resembles a legitimate VMware domain. This practice, known as typosquatting, is aimed at deceiving users and security measures, ultimately facilitating the compromise of targeted systems.

Originally identified in 2004, Bifrost enables attackers to remotely access compromised systems and gather sensitive information, such as hostnames and IP addresses. Its latest iteration underscores a concerning trend of increased activity in Bifrost's Linux variants, which has raised alarms among security experts and organizations.

The malware's modus operandi involves communication with a command and control (C2) server through the deceptive domain. To obfuscate its presence and hinder analysis, the malware is compiled as a stripped binary, a common tactic used by attackers. This stripping process removes debugging information and symbol tables, making it more challenging for security analysts to dissect its operations.

Upon execution, the malware initiates a series of actions, including the establishment of a socket for communication and the collection of user data. This data, which may include sensitive information such as hostnames and process identifiers (PIDs), is then encrypted using RC4 encryption, a technique aimed at concealing the transmitted data from detection.

Furthermore, the malware attempts to contact a public Domain Name System (DNS) resolver, specifically one located in Taiwan with the IP address 168.95.1[.]1. This step is crucial for resolving the deceptive domain and establishing communication with the C2 server, thereby facilitating the exfiltration of data and remote control of the compromised system.

Security Officer Comments:
Notably, analysis reveals that the malicious IP address associated with the C2 server hosts an ARM version of the Bifrost malware, indicating the attacker's efforts to broaden their attack surface. By providing versions compatible with both x86 and ARM architectures, attackers can target a wider range of devices, including those increasingly prevalent in IoT and embedded systems.

Suggested Corrections:
Keeping endpoint and security tools updated is essential for maintaining a robust cybersecurity posture. Regular updates ensure that known vulnerabilities are patched promptly, reducing the risk of exploitation by cybercriminals. Updated security tools are equipped with the latest threat intelligence and detection mechanisms, enabling organizations to effectively identify and mitigate evolving cyber threats.

Link(s):
https://thehackernews.com/2024/03/new-bifrose-linux-malware-variant-using.html