Rekoobe
Rekoobe is a Linux trojan/backdoor that has been detected in the wild since at least 2015. The content describes it as a backdoor capable of receiving commands from an attacker-controlled server to download additional payloads, steal files, and execute a reverse shell. It is associated in the reporting with Chinese nation-state activity, particularly APT31 (also referred to as Zirconium), and one source notes partial lineage from the Tiny SHell codebase.
In the provided reporting, Rekoobe was delivered as a later-stage payload in a supply-chain attack involving a malicious Go module, github.com/xinfeisoft/crypto, which impersonated the legitimate golang.org/x/crypto package. That module modified ssh/terminal/terminal.go and hooked ReadPassword() to capture plaintext credentials entered at terminal prompts, write them locally to /usr/share/nano/.lock, exfiltrate them to attacker-controlled infrastructure, and then execute a shell-script stager. The stager established persistence by appending an attacker SSH key to /home/ubuntu/.ssh/authorized_keys, weakened host defenses by setting iptables default policies to ACCEPT, and downloaded additional payloads disguised as .mp5 files. The payload 555.mp5 was confirmed as the Rekoobe Linux backdoor; the staged payloads also included sss.mp5 as a loader/reconnaissance component.
Observed infrastructure and indicators directly mentioned in the content include communication with 154.84.63.184 over TCP port 443, including at least one flow that did not resemble a standard TLS ClientHello; staged payload names sss.mp5 and 555.mp5; SHA-256 for 555.mp5: 8b0ec8d0318347874e117f1aed1b619892a7547308e437a20e02090e5f3d2da6; and SHA-256 for sss.mp5: 4afdb3f5914beb0ebe3b086db5a83cef1d3c3c4312d18eff672dd0f6be2146bc. Separate Fortinet reporting in the content states that malware in one FortiOS intrusion cluster bore similarities to Rekoobe malware commonly used by APT31, in campaigns targeting highly selected victims including government, critical infrastructure, manufacturing, consultancies, and service providers/ISPs.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques"A malicious Go module, disguised as a legitimate crypto library... exploits namespace confusion to appear routine in dependency graphs."
“uncovered a malicious Go module, github[.]com/xinfeisoft/crypto, that imitates the legitimate golang.org/x/crypto codebase but inserts a backdoor…”
Execution
3 techniques“deploys the Rekoobe backdoor…”; “new Windows RAT named Moonrise…”
"Upon successful exfiltration, the module fetches and executes a shell script. This script acts as a Linux stager..."
“Any application that vendors or imports this module and invokes ReadPassword becomes a credential collection point.”
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
3 techniques“downloads additional payloads… while disguising them with the .mp5 extension”
"executes them, and deletes them from disk to reduce forensic evidence."
“then deletes the dropped files to reduce on disk artifacts”
Credential Access
1 techniqueCollection
2 techniquesCommand and Control
4 techniques"The backdoor is capable of receiving commands from an attacker-controlled server to download more payloads, steal files, and execute a reverse shell."
“exfiltrates passwords via HTTP POST… fetches a GitHub hosted ‘update’ resource”
"downloading further payloads. One of these payloads is a reconnaissance or loader program, while the other is the Rekoobe backdoor"
"communicated with 154[.]84[.]63[.]184 over TCP port 443 without a standard TLS handshake, suggesting custom encrypted traffic designed to pass as HTTPS."
Exfiltration
1 technique"capture sensitive credentials... and send them to a remote endpoint."
Other
1 techniqueIOCs tracked for this family
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux backdoor/RAT delivered via a malicious Go supply-chain package; used to establish unauthorized access on Linux systems after credential harvesting and staging activity.
A backdoor deployed by a malicious Go module; the trojanized library steals user passwords and then installs the Rekoobe backdoor on compromised systems.
Linux backdoor/trojan that communicates with an attacker-controlled server to receive commands, download additional payloads, steal files, and provide reverse shell capability.
Linux backdoor delivered via a multi-stage supply-chain-driven dropper chain. In this campaign it is fetched from attacker infrastructure, executed on the victim host, and communicates outbound to 154[.]84[.]63[.]184 over TCP/443 using non-standard (non-TLS-handshake) traffic suggestive of custom encryption masquerading as HTTPS.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.