Loading story…
Group-IB disclosed a previously undocumented Linux remote access trojan, Krasue, that has been active since at least 2021 and has primarily targeted organizations in Thailand, including telecommunications companies. The malware is designed to preserve long-term access on compromised Linux systems, using AES-CBC encrypted command-and-control communications and masking keepalive traffic as RTSP DESCRIBE requests to blend into normal network activity. Investigators said Krasue is likely deployed in later stages of intrusions, potentially by botnet operators or initial access brokers, and notifications were sent to ThaiCERT and TTC-CERT.
Krasue also carries an embedded Linux kernel-module rootkit built for multiple kernel versions, enabling it to hide files, processes, ports, and its own presence while resisting termination. Group-IB assessed with moderate confidence that the malware shares a rootkit author or source-code lineage with XorDdos, a long-observed Linux malware family previously documented by Microsoft as a stealthy threat targeting Linux devices. While attribution to a specific threat actor remains inconclusive, the overlap suggests Krasue may be part of a broader ecosystem of Linux-focused malware used to maintain covert persistence on enterprise systems.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a security blog analyzing XorDdos as a stealthy DDoS malware family targeting Linux devices. This prior public reporting provides context for Group-IB's later assessment of code or author overlap between Krasue and XorDdos.
Group-IB reported that the previously undocumented Linux remote access trojan Krasue has been active since at least 2021, based on samples first registered on VirusTotal that year. The malware predominantly targeted organizations in Thailand, including telecommunications companies.
Group-IB disclosed a previously undocumented Linux RAT named Krasue, detailing its AES-CBC-encrypted command-and-control, RTSP DESCRIBE keepalive camouflage, and embedded kernel rootkit. The company also said it had notified ThaiCERT and TTC-CERT and assessed with moderate confidence that Krasue shares a rootkit author or source-code lineage with XorDdos.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Researchers reported continued use of the **Rekoobe** Linux backdoor in intrusions tied to China-linked **APT31**, including attacks against Korean organizations and Linux servers. Rekoobe, derived from the open-source Tiny SHell project, has appeared in multiple variants across `x86`, `x64`, and `SPARC` systems and typically provides file upload, file download, and reverse shell access. In one analyzed case, the malware contacted `resolv.ctmailer[.]net:80`, disguised its process name as `/bin/bash`, and protected command-and-control traffic with **AES-128** encryption derived from an **HMAC-SHA1** routine and a hard-coded password. Separate analysis found Rekoobe operating alongside the **Syslogk** Linux kernel rootkit, forming a stealthy persistence and remote access toolkit. Syslogk, based on the open-source **Adore-Ng** rootkit, hides files, processes, and network activity, removes itself from kernel module listings, and can remotely start or stop Rekoobe using specially crafted TCP magic packets. Researchers also observed Rekoobe masquerading as a fake SMTP service and spawning a shell after receiving a specific backdoor command over TLS, reinforcing that the malware remains an active and adaptable threat to poorly maintained or unpatched Linux environments.
Aug 15, 2026
Researchers identified **RedXOR**, a Linux backdoor disguised as a `polkit` daemon, and assessed it was likely operated by a Chinese nation-state actor based on victimology, tactics, and code overlaps with malware associated with the **Winnti** umbrella. The malware targets Linux endpoints and servers, persists through init scripts, and uses the **Adore-ng** LKM rootkit for stealth. It supports host reconnaissance, file manipulation, remote shell access, self-update and uninstall functions, rootkit deployment, and network tunneling through a modified **Rinetd** component. RedXOR communicates with command-and-control infrastructure over TCP traffic made to resemble HTTP and uses XOR-based encoding to obscure data in transit. Researchers reported low antivirus detection and observed sample uploads from **Taiwan** and **Indonesia**, while intermittent command-and-control availability suggested the operation was active during analysis. The activity was framed against broader reporting on Chinese intrusion groups, including archived references to **APT41** and long-running Chinese cyber-espionage operations, reinforcing the assessment that RedXOR fits an established pattern of Linux-focused tooling used in state-linked campaigns.
Aug 15, 2026