Loading malware…
Rekoobe is a Linux backdoor malware family derived in part from the open-source Tiny SHell codebase and observed in the wild since at least 2015. It has been linked in multiple investigations to China-aligned intrusion activity, particularly APT31, and has appeared both as a standalone Linux implant and as a payload paired with stealth components such as kernel rootkits. Rekoobe has been reported targeting Linux servers, including x86, x64, and SPARC systems, and has been seen in campaigns affecting organizations in Korea as well as broader server-focused intrusions.
The malware’s core functionality centers on remote command execution and file transfer. Documented capabilities include reverse shell access, file upload, file download, and retrieval of additional payloads from attacker-controlled infrastructure. Variants have been described as using encrypted command-and-control communications based on HMAC-SHA1-derived AES-128 keys, with hard-coded configuration embedded in the binary rather than supplied at runtime. Some samples disguise their process name as a legitimate shell process to hinder detection. Both reverse-shell and bind-shell style variants have been reported.
Rekoobe has also been deployed as part of multi-stage compromises. In one supply-chain scenario, a malicious Go module impersonating a legitimate cryptographic library harvested terminal-entered passwords, executed a shell-script stager, weakened host defenses, established SSH persistence, and then delivered Rekoobe as a Linux backdoor. In other cases, Rekoobe has been used alongside Linux rootkits such as Syslogk, which can hide the payload, conceal related processes and network activity, and trigger the backdoor through specially crafted magic packets. Research has also noted similarities between Rekoobe and customized TinySHell-based backdoors used with Reptile-style rootkit tradecraft.
Rekoobe is best characterized as a stealth-oriented Linux backdoor used in post-compromise operations for persistent remote access, file theft, and follow-on payload delivery.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Rekoobe is a backdoor known to be used by APT31, a threat group based in China.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Additionally, there have been reported cases of supply chain attacks where a threat actor targeted a popular WordPress plugin and installed Rekoobe to gain control over compromised systems.
The reverse shell command also has a simple format of redirecting the standard input and output to the socket connected to the C&C server and executing /bin/sh.
"adding a threat actor's SSH key to the 'authorized_keys' file"
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine... These are known as magic packets because they have a special format and special powers.
Adore-Ng is a relatively old, open-source, well-known kernel rootkit for Linux... It enables hiding processes, files, and even the kernel module... In this post, we refer to this rootkit as Syslogk rootkit.
Rekoobe disguises itself by changing its process name to “/bin/bash”, which matches the name of a normal process.
“downloads additional payloads… while disguising them with the .mp5 extension”
"executes them, and deletes them from disk to reduce forensic evidence."
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine... These are known as magic packets because they have a special format and special powers.
First, it checks whether the packet is a TCP packet and, in that case, it also checks the source port, which is expected to be 59318. Rekobee will be executed by the rootkit if the magic packet fits the mentioned criteria.
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine, which inspects the traffic by installing a netfilter hook.
The malicious payload is hidden from tools like Netstat; when running, it will not appear in the list of services. For this purpose, the rootkit uses the function hk_t4_seq_show.
“exfiltrates passwords via HTTP POST… fetches a GitHub hosted ‘update’ resource”
Depending on the value of this 1 byte, three different commands can be performed: file upload, file download, or reverse shell execution.
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine... These are known as magic packets because they have a special format and special powers.
First, it checks whether the packet is a TCP packet and, in that case, it also checks the source port, which is expected to be 59318. Rekobee will be executed by the rootkit if the magic packet fits the mentioned criteria.
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine, which inspects the traffic by installing a netfilter hook.
It is a compiled backdoor trojan written in C programming language... widely known as the Rekoobe malware family... embedded in a fake SMTP server, which spawns a shell when it receives a specially crafted command.
104 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a malware family related to Noodle RAT, which is described as a variant of Rekoobe.
Linux backdoor/RAT delivered via a malicious Go supply-chain package; used to establish unauthorized access on Linux systems after credential harvesting and staging activity.
A backdoor deployed by a malicious Go module; the trojanized library steals user passwords and then installs the Rekoobe backdoor on compromised systems.
Linux backdoor/trojan that communicates with an attacker-controlled server to receive commands, download additional payloads, steal files, and provide reverse shell capability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.