Loading story…
Researchers identified Mokes, a cross-platform desktop backdoor family with Linux and Windows variants, later also linked to an OS X sample. The malware was designed for surveillance and data theft, supporting screenshots, keylogging, audio capture, and exfiltration of collected information. The Linux sample, detected as Backdoor.Linux.Mokes.a, was described as a UPX-packed C++/Qt implant statically linked with Qt, xkbcommon, and OpenSSL 1.0.2c, while the Windows samples were tracked as Backdoor.Win32.Mokes.imv and Backdoor.Win32.Mokes.imw.
Both variants used similar persistence and command-and-control logic, indicating a shared code base and operator playbook. On Linux, Mokes established autostart persistence; on Windows, it used Run registry keys and added active keylogging, with code also present for webcam capture. The malware beaconed every minute to hardcoded HTTP command-and-control servers and used TCP port 433 with a custom encrypted protocol for commands and data transfer. Researchers also noted that one Windows sample was signed with a trusted certificate chaining to COMODO RSA Code Signing CA, a tactic that could help the malware appear legitimate and evade scrutiny.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky researchers analyzed Backdoor.OSX.Mokes.a, detailing its surveillance and theft capabilities, persistence via LaunchAgents, and encrypted command-and-control workflow. The report also published indicators of compromise including hashes, domains, an IP address, file paths, and a hardcoded User-Agent.
Analysis of the Linux Mokes sample found Qt installation timestamps indicating the malware was compiled no earlier than late September 2015 on Ubuntu 14.04 LTS.
A later Windows sample, detected as Backdoor.Win32.Mokes.imw, was reported as the first observed Mokes variant with its audio capture module activated, creating a new audio file every five minutes.
Researchers identified Mokes as a new desktop backdoor family spanning Linux and Windows, with surveillance and data exfiltration capabilities. The report also noted that an OS X variant was subsequently found.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **ACBackdoor**, a cross-platform malware family targeting both **Linux** and **Windows** systems. The backdoor enables arbitrary command execution, binary execution, persistence, host reconnaissance, and malware updates, while both variants communicate with the same HTTPS-based command-and-control infrastructure. Analysis indicated the Linux sample was more sophisticated than the Windows version, suggesting the malware may have been developed for Linux first and later adapted for Windows. The Windows variant was reportedly distributed through **malvertising** tied to the **Fallout Exploit Kit**, which exploited `CVE-2018-15982` and `CVE-2018-8174` to infect victims. Researchers said the Linux delivery method remained unknown, but both versions used platform-specific persistence and masquerading techniques to evade detection and maintain access on compromised hosts.
Aug 14, 2026
Researchers reported continued use of the **Rekoobe** Linux backdoor in intrusions tied to China-linked **APT31**, including attacks against Korean organizations and Linux servers. Rekoobe, derived from the open-source Tiny SHell project, has appeared in multiple variants across `x86`, `x64`, and `SPARC` systems and typically provides file upload, file download, and reverse shell access. In one analyzed case, the malware contacted `resolv.ctmailer[.]net:80`, disguised its process name as `/bin/bash`, and protected command-and-control traffic with **AES-128** encryption derived from an **HMAC-SHA1** routine and a hard-coded password. Separate analysis found Rekoobe operating alongside the **Syslogk** Linux kernel rootkit, forming a stealthy persistence and remote access toolkit. Syslogk, based on the open-source **Adore-Ng** rootkit, hides files, processes, and network activity, removes itself from kernel module listings, and can remotely start or stop Rekoobe using specially crafted TCP magic packets. Researchers also observed Rekoobe masquerading as a fake SMTP service and spawning a shell after receiving a specific backdoor command over TLS, reinforcing that the malware remains an active and adaptable threat to poorly maintained or unpatched Linux environments.
Aug 15, 2026
Researchers linked a supply-chain compromise of the Chinese-language chat application **MìMì** to the China-nexus **LuckyMouse**/**Iron Tiger** intrusion set, which distributed trojanized versions for **Windows, macOS, and Linux**. On macOS, malicious builds starting with version `2.3.0` downloaded and executed the **RShell** Mach-O backdoor, while related Windows activity used **HyperBro** and Linux variants also deployed **RShell**, indicating a coordinated cross-platform operation delivered through the same messaging software. The campaign reused infrastructure previously associated with LuckyMouse, including overlaps between RShell command-and-control servers and hosting tied to HyperBro, strengthening attribution to the group also tracked as **TA428**. RShell was described as a C++ implant that communicated over unencrypted **BJSON over TCP** and supported remote shell and file-management functions, while published indicators included malware hashes, command-and-control servers, and download URLs used to deliver the poisoned application, suggesting a targeted surveillance-focused intrusion via compromised corporate software.
Aug 15, 2026