Loading story…
Researchers reported continued use of the Rekoobe Linux backdoor in intrusions tied to China-linked APT31, including attacks against Korean organizations and Linux servers. Rekoobe, derived from the open-source Tiny SHell project, has appeared in multiple variants across x86, x64, and SPARC systems and typically provides file upload, file download, and reverse shell access. In one analyzed case, the malware contacted resolv.ctmailer[.]net:80, disguised its process name as /bin/bash, and protected command-and-control traffic with AES-128 encryption derived from an HMAC-SHA1 routine and a hard-coded password.
Separate analysis found Rekoobe operating alongside the Syslogk Linux kernel rootkit, forming a stealthy persistence and remote access toolkit. Syslogk, based on the open-source Adore-Ng rootkit, hides files, processes, and network activity, removes itself from kernel module listings, and can remotely start or stop Rekoobe using specially crafted TCP magic packets. Researchers also observed Rekoobe masquerading as a fake SMTP service and spawning a shell after receiving a specific backdoor command over TLS, reinforcing that the malware remains an active and adaptable threat to poorly maintained or unpatched Linux environments.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
ASEC published analysis of Rekoobe use against Korean organizations, linking the Linux backdoor to APT31 and describing multiple Korean-targeting samples and command-and-control endpoints. The report said ASEC had received Rekoobe malware reports from tenants in Korea for several years and assessed that poorly maintained or unpatched Linux servers were likely targets.
Avast disclosed technical analysis of Syslogk, a rootkit based on Adore-Ng, and the associated Rekoobe backdoor hidden at /etc/rc-Zobk0jpi/PgSD93ql. The report detailed how Syslogk concealed files, processes, and network activity and remotely started or stopped Rekoobe using crafted TCP packets.
Researchers found the Syslogk Linux kernel rootkit and its paired Rekoobe payload in the wild in early 2022. The analysis concluded the rootkit and backdoor were likely designed to operate together as a stealthy persistence and remote access toolkit.
ASEC reported that an updated version of Rekoobe was used in attacks in 2018, indicating continued development and operational use of the Linux backdoor.
Dr.Web published a malware description entry for Linux.Rekoobe.1, marking an early public documentation point for the Rekoobe Linux backdoor family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 85 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
sansec.io
Open sourceasec.ahnlab.com
Open sourcedecoded.avast.io
Open sourcevms.drweb.com
Open sourceblog.sekoia.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple Linux intrusions to suspected Chinese state-sponsored activity using the open-source **Reptile** kernel rootkit and a custom implant known as **Mélofée**. ExaTrack reported that Mélofée targeted Linux servers with capabilities for file and directory operations, shell execution, persistence, and command-and-control over **TCP**, **TLS**, and **UDP/KCP**, while one 2022 sample embedded a kernel-mode rootkit derived from Reptile. The installer deployed components under the disguised path `/etc/intel_audio/`, loaded the malicious kernel module with `insmod`, and established persistence through startup files such as `/etc/rc.modules`, tying the activity to infrastructure and tooling associated with **Winnti**, **ShadowPad**, **PlugX**, **Spark**, **HelloBot**, **StowAway**, and **Cobalt Strike**. AhnLab later documented a Korean intrusion that used Reptile in a nearly identical way, including installation under `/etc/intel_audio/`, manual kernel-module loading instead of the default loader flow, persistence via `rc.local`, and deployment alongside an **ICMP** backdoor called **ISH**. Reptile provides stealth features for files, directories, processes, file contents, and network traffic, and can activate a reverse shell through a **Port Knocking** mechanism using Magic Packets. The overlap in installation path and deployment method matched patterns previously highlighted by ExaTrack and reinforced assessments that Reptile-derived Linux rootkits were being operationalized in broader Chinese espionage campaigns, including activity Mandiant associated with exploitation of **Fortinet** zero-days and custom malware.
Aug 15, 2026
Researchers identified **RedXOR**, a Linux backdoor disguised as a `polkit` daemon, and assessed it was likely operated by a Chinese nation-state actor based on victimology, tactics, and code overlaps with malware associated with the **Winnti** umbrella. The malware targets Linux endpoints and servers, persists through init scripts, and uses the **Adore-ng** LKM rootkit for stealth. It supports host reconnaissance, file manipulation, remote shell access, self-update and uninstall functions, rootkit deployment, and network tunneling through a modified **Rinetd** component. RedXOR communicates with command-and-control infrastructure over TCP traffic made to resemble HTTP and uses XOR-based encoding to obscure data in transit. Researchers reported low antivirus detection and observed sample uploads from **Taiwan** and **Indonesia**, while intermittent command-and-control availability suggested the operation was active during analysis. The activity was framed against broader reporting on Chinese intrusion groups, including archived references to **APT41** and long-running Chinese cyber-espionage operations, reinforcing the assessment that RedXOR fits an established pattern of Linux-focused tooling used in state-linked campaigns.
Aug 15, 2026
Researchers reported a Go supply-chain attack in which a malicious module, `github[.]com/xinfeisoft/crypto`, impersonates the widely trusted `golang.org/x/crypto` codebase (and its GitHub mirror) to blend into developer dependency graphs via namespace confusion. The module was publicly listed on *pkg.go.dev* as `v0.15.0` and replicated the legitimate repository’s structure and subpackages (e.g., `bcrypt`, `argon2`, `ssh`) to reduce suspicion during review. The backdoor was embedded in `ssh/terminal/terminal.go` by modifying the `ReadPassword` helper so that, during interactive password entry, it captures credentials in plaintext and writes them to `/usr/share/nano/.lock`, then contacts attacker-controlled resources for follow-on actions. Reported post-compromise behavior includes fetching an “update” pointer hosted on GitHub, exfiltrating the harvested password to an attacker endpoint, downloading and executing a shell script stager, appending an attacker SSH key to `/home/ubuntu/.ssh/authorized_keys`, changing `iptables` default policies to `ACCEPT`, and downloading additional payloads from `img[.]spoolsv[.]cc` disguised with a `.mp5` extension; analyzed payloads (e.g., `sss.mp5`, `555.mp5`) were identified as the **Rekoobe** Linux backdoor.
Jun 29, 2026