Loading story…
Researchers have disclosed PamDOORa, a Linux backdoor that abuses the Pluggable Authentication Module (PAM) framework to steal SSH credentials and maintain covert persistence on already-compromised x86_64 systems. Advertised on the Russian-speaking cybercrime forum Rehub by an actor using the alias "darkworm," the malware is positioned as a post-exploitation toolkit and was reportedly offered for sale with its source code. It intercepts credentials from legitimate users during authentication by abusing pam_exec and inserting a malicious PAM component into the login stack.
PamDOORa also enables hidden SSH access through a magic password tied to a specific TCP port, while anti-forensic functions tamper with records such as lastlog, btmp, utmp, and wtmp to conceal activity and complicate investigations. Researchers said the malware appears to require prior root-level compromise for deployment, and there is no confirmed evidence yet of active in-the-wild attacks, but they described it as a more mature, operator-grade evolution of earlier PAM backdoor concepts because of its modular design, anti-debugging features, network-aware triggers, and builder pipeline.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers reported a new Linux PAM-based backdoor named PamDOORa that steals SSH credentials, enables covert SSH access via a magic password and specific TCP port, and tampers with authentication logs such as lastlog, btmp, utmp, and wtmp. Group-IB and Flare.io described it as requiring prior root compromise for deployment and noted there was no evidence of real-world attacks at the time of disclosure.
A threat actor using the alias "darkworm" advertised the PamDOORa malware on the Russian-speaking cybercrime forum Rehub as a post-exploitation toolkit for x86_64 Linux systems. Reporting indicates the source code was offered for sale, with one account noting the price later dropped from $1,600 to $900.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported that attackers can abuse Linux **Pluggable Authentication Modules (PAM)** by modifying SSH authentication settings to invoke the `pam_exec` module, turning a legitimate feature into a stealthy credential-theft and persistence mechanism. In the demonstrated technique, a malicious script is triggered during SSH login attempts—including failed authentications—to collect usernames and environment data and send them to a remote host, while standard logs may show only unsuccessful SSH access and not the hidden execution path. The technique affects a core authentication framework used by services such as **`sshd`**, `login`, `su`, and `passwd`, making PAM configuration integrity a high-value defensive priority on Linux systems. Group-IB said the same approach could support backdoors, covert command execution, and long-term persistence, and recommended hardening measures including timely patching, enforcing **SELinux** or **AppArmor**, monitoring with **Auditd** and **Wazuh**, and using tools such as **PSAD**, **AIDE**, and **rkhunter** to detect unauthorized changes and suspicious activity.
Jun 29, 2026
Sygnia reported that the China-linked threat group **Velvet Ant** maintained covert access to an organization's network for nearly a decade by modifying trusted Linux authentication components in an intrusion campaign dubbed **Operation Highland**. Instead of relying on conventional malware, the attackers backdoored **PAM** and **OpenSSH** to bypass authentication with a secret password, steal legitimate credentials, and log commands while blending in with normal administrative activity. Researchers identified **nine distinct versions** of the tampered software, indicating the operation evolved over years and that the earliest observed activity dates back to **2016**. The intrusion reportedly reached an air-gapped or otherwise isolated environment by staging through internet-facing systems and using a web server as a bridge into the segmented network. Sygnia said the case shows why patching and password resets alone are insufficient when trusted login binaries have been altered, and urged defenders to verify the integrity of PAM and OpenSSH files against known-good copies, remove backdoors before resetting credentials, and monitor or patch related edge infrastructure. The tradecraft aligns with Velvet Ant's broader pattern of hiding in trusted systems, including prior activity involving **F5 BIG-IP** devices and exploitation of **`CVE-2024-20399`** on **Cisco NX-OS** switches.
Jul 12, 2026
Analysis of the Linux backdoor **BPFDoor** shows the malware copying itself to `/dev/shm/kdmtmpflush`, changing the file’s permissions, and then re-launching the new instance through `execve` with the `--init` flag to complete setup. During execution it checks for `/var/run/haldrund.pid` to avoid multiple starts, deletes any prior copy of the payload, and timestomps the replacement file to `2008-10-30 19:17:16 UTC` to reduce suspicion. Runtime tracing also showed the malware adopting deceptive process names including `dbus-daemon --system` and `/usr/libexec/postfix/master` to blend into normal Linux activity. The traced sample then created a raw packet socket and attached a BPF filter with `SO_ATTACH_FILTER`, enabling BPFDoor to watch for specially crafted network traffic used to activate the implant. The backdoor was reported to respond to magic packets containing hardcoded passwords such as `justforfun` or `socket`, after which it could send a ping, spawn a reverse shell, or open a bind shell. The behavior highlights a stealth-focused Linux implant that combines fileless-style staging in shared memory, process masquerading, and packet-triggered remote access.
Aug 1, 2026