Loading malware…
28 distinct techniques documented for this family, organized by ATT&CK tactic.
This could enable supply-chain attacks where the threat actor publishes malicious packages on code distribution platforms.
The malware uses seven distinct persistence mechanisms, including LD_PRELOAD, systemd, crontab, init.d scripts, XDG autostart, and ‘.bashrc’ injection, ensuring it loads into every dynamically linked process and respawns if killed.
RAT core — Central control component built around a 58-command framework that provides interactive shell access, file and process management, system control, and network operations, while maintaining persistent communication with the C2 over custom TCP/TLS or HTTP/S channels.
The compiled rootkit loads system-wide by modifying a file that forces every newly spawned process to load the malicious library.
File Path /etc/init.d/quasar_linux RC script dropped for boot-time persistence
The malware uses seven distinct persistence mechanisms, including LD_PRELOAD, systemd, crontab, init.d scripts, XDG autostart, and ‘.bashrc’ injection, ensuring it loads into every dynamically linked process and respawns if killed.
Credential access layer — Combines credential harvesting (SSH keys, browsers, cloud and developer configs, /etc/shadow, clipboard) with PAM-based backdoors that intercept and log plaintext authentication data.
Indicators of Compromise (IoCs):- File Name quasar_linux.service Systemd service file dropped under /etc/systemd/system/ and ~/.config/systemd/user/ for persistence
File Path ~/.config/autostart/quasar_linux.desktop XDG autostart entry for desktop logon persistence
The malware then compiles its embedded rootkit and PAM backdoor source against local kernel headers using the victim’s own gcc... File Name pam_security.so Malicious PAM module deployed to intercept authentication
File Path /etc/init.d/quasar_linux RC script dropped for boot-time persistence
The malware uses seven distinct persistence mechanisms, including LD_PRELOAD, systemd, crontab, init.d scripts, XDG autostart, and ‘.bashrc’ injection, ensuring it loads into every dynamically linked process and respawns if killed.
Unlike most malware that relies on files stored on disk, QLNX runs almost entirely in memory. On launch, it creates a file that exists only in memory, writes its real payload into it, executes that payload, then removes the original file from disk.
Credential access layer — Combines credential harvesting (SSH keys, browsers, cloud and developer configs, /etc/shadow, clipboard) with PAM-based backdoors that intercept and log plaintext authentication data.
Indicators of Compromise (IoCs):- File Name quasar_linux.service Systemd service file dropped under /etc/systemd/system/ and ~/.config/systemd/user/ for persistence
File Path ~/.config/autostart/quasar_linux.desktop XDG autostart entry for desktop logon persistence
Kernel module bytes are loaded from memory, a file descriptor, or another transient source: memfd_create → module bytes → init_module / finit_module.
To avoid attracting attention, QLNX rewrites its own process name to mimic legitimate kernel worker threads like [kworker/0:0] or [migration/0].
Unlike most malware that relies on files stored on disk, QLNX runs almost entirely in memory. On launch, it creates a file that exists only in memory, writes its real payload into it, executes that payload, then removes the original file from disk.
QLNX was designed for stealth and long-term persistence, as it runs in-memory, deletes the original binary from disk, wipes logs, spoofs process names, and clears forensic environment variables.
The compiled rootkit loads system-wide by modifying a file that forces every newly spawned process to load the malicious library.
Execution and injection engine — Process injection (ptrace, /proc/pid/mem) and in-memory execution of payloads (shared objects, BOF/COFF).
The malware then compiles its embedded rootkit and PAM backdoor source against local kernel headers using the victim’s own gcc... File Name pam_security.so Malicious PAM module deployed to intercept authentication
QLNX was designed for stealth and long-term persistence, as it runs in-memory, deletes the original binary from disk, wipes logs, spoofs process names, and clears forensic environment variables.
Credential access layer — Combines credential harvesting (SSH keys, browsers, cloud and developer configs, /etc/shadow, clipboard) with PAM-based backdoors that intercept and log plaintext authentication data.
Surveillance module — Keylogging, screenshot capture, and clipboard monitoring.
Once executed, it shifts its payload into memory and leaves no trace on the file system, then plants itself into the operating system to harvest SSH keys, cloud credentials, package registry tokens, and browser-stored passwords.
Once executed, it shifts its payload into memory and leaves no trace on the file system, then plants itself into the operating system to harvest SSH keys, cloud credentials, package registry tokens, and browser-stored passwords.
The malware then compiles its embedded rootkit and PAM backdoor source against local kernel headers using the victim’s own gcc... File Name pam_security.so Malicious PAM module deployed to intercept authentication
Once executed, it shifts its payload into memory and leaves no trace on the file system, then plants itself into the operating system to harvest SSH keys, cloud credentials, package registry tokens, and browser-stored passwords.
Networking and lateral movement — TCP tunneling, SOCKS proxy, port scanning, SSH-based lateral movement, and peer-to-peer mesh networking.
Filesystem monitoring — Real-time tracking of file activity via inotify.
Networking and lateral movement — TCP tunneling, SOCKS proxy, port scanning, SSH-based lateral movement, and peer-to-peer mesh networking.
Surveillance module — Keylogging, screenshot capture, and clipboard monitoring.
Surveillance module — Keylogging, screenshot capture, and clipboard monitoring.
Surveillance module — Keylogging, screenshot capture, and clipboard monitoring.
RAT core — Central control component built around a 58-command framework that provides interactive shell access, file and process management, system control, and network operations, while maintaining persistent communication with the C2 over custom TCP/TLS or HTTP/S channels.
Networking and lateral movement — TCP tunneling, SOCKS proxy, port scanning, SSH-based lateral movement, and peer-to-peer mesh networking.
A peer-to-peer mesh connects infected hosts so removing one command node does not cut off the attacker.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.