Loading malware…
PeerTime is a Linux ELF backdoor used in a telecom-focused intrusion campaign attributed to the China-linked activity cluster UAT-9244, which Cisco Talos assessed overlaps with FamousSparrow and Tropic Trooper. It has targeted South American telecommunications providers since at least 2024 and is intended to run across multiple architectures commonly found in embedded and network infrastructure, including x86/AMD64, ARM, AArch64, MIPS, and PowerPC, enabling compromise of Linux servers, routers, embedded systems, and other edge infrastructure. PeerTime uses the BitTorrent protocol for peer-to-peer command and control, retrieving instructions and downloading additional payloads from peers rather than relying on a centralized C2 server, which helps blend malicious traffic with legitimate P2P activity and complicates detection and infrastructure attribution. Reported capabilities include downloading files from peers, executing them on the infected host, process renaming or masquerading as legitimate system programs, and persistence via crontab @reboot entries; deployment has been described as involving shell scripts and a loader/instrumentor that decrypts and decompresses the final payload in memory, and one report noted the instrumentor checks for Docker before execution. Two versions have been identified: an older C/C++ implementation and a newer Rust implementation. Infrastructure associated with PeerTime included the domains bloopencil[.]net, xtibh[.]com, and xcit76[.]com. Mandiant Backscatter tracks PeerTime as malware_config:angrypeer.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
One of the Linux payloads, known as PeerTime, supports several architectures commonly found in embedded and network infrastructure: ARM AArch64 MIPS PowerPC x86
"...“PeerTime,” an ELF-based backdoor that uses the BitTorrent protocol to conduct malicious operations..."
...targeted... with the newly discovered TernDoor and PeerTime backdoors for Windows and Linux, respectively... the ELF-based peer-to-peer PeerTime backdoor, which has C/C++ and Rust versions...
...targeted... with the newly discovered TernDoor and PeerTime backdoors for Windows and Linux, respectively... the ELF-based peer-to-peer PeerTime backdoor, which has C/C++ and Rust versions...
16 distinct techniques documented for this family, organized by ATT&CK tactic.
"The exact initial access method used in the attacks is not known, although the adversary has previously targeted systems running outdated versions of Windows Server and Microsoft Exchange Server to drop web shells for follow-on activity."
PeerTime: BitTorrent as C2 ... Persistence Crontab injection: (crontab -l ; echo "@reboot %s") | crontab -
"permits remote shell command"
“The instrumentor ELF binary will check for the presence of docker… If docker is found, then the PeerTime loader is executed using: docker <path_of_PeerTime_loader_ELF>”
PeerTime: BitTorrent as C2 ... Persistence Crontab injection: (crontab -l ; echo "@reboot %s") | crontab -
PeerTime: BitTorrent as C2 ... Persistence Crontab injection: (crontab -l ; echo "@reboot %s") | crontab -
"The malware also can disguise its processes as legitimate system programs"
"...rogue DLL ... decrypts and executes the final payload in memory." / "...decodes a configuration to extract the command-and-control (C2) parameters." / "...decrypt and decompress the final PeerTime payload and execute it directly in memory."
"...decrypts and executes the final payload in memory." / "...execute it directly in memory."
Once attackers gain foothold access, infected Linux systems can become relay nodes for persistence, scanning, brute-force activity, and covert communications.
“Reads and writes files”
One report noted that the malware checks whether Docker is installed before execution.
One detail stands out immediately: the Linux malware reportedly uses peer-to-peer communication methods and BitTorrent-style traffic patterns instead of relying entirely on centralized command-and-control servers.
"convert breached devices into operational relay boxes"
The malware also appears designed to turn compromised Linux systems into Operational Relay Boxes, or ORBs. Once foothold access is established, the infected host becomes part of the attacker’s infrastructure: relaying malicious traffic staging brute-force attempts scanning external targets masking the attacker's origin supporting lateral movement
MITRE ATT&CK Mapping ... Command and Control T1095 Non-Application Layer Custom TLS 1.3, BitTorrent (PeerTime)
“PeerTime is a Linux-based backdoor that leverages the BitTorrent protocol to communicate and execute tasks on infected systems...”
"targeted... with the newly discovered TernDoor and PeerTime backdoors... as well as the BruteEntry brute-force scanner"
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.