Loading story…
Palo Alto Networks detailed Fysbis, a Linux trojan/backdoor attributed to the Sofacy group (APT28/Sednit), describing multiple samples spanning late 2014 through late 2015. The malware was found in both 32-bit and 64-bit ELF variants and could install either with or without root privileges, giving operators flexibility across different Linux environments. Researchers said the backdoor was modular, maintained persistence, and exposed its installation paths, capabilities, and configuration through relatively straightforward static analysis.
The newest observed variant showed incremental changes rather than a major redesign, including added obfuscation and use of the command-and-control domain mozilla-plugins[.]com, while retaining strong code and behavioral overlap with earlier samples tied to known Sofacy infrastructure. The reporting indicates that Fysbis was not especially sophisticated but remained operationally effective for cyber-espionage activity, underscoring that Linux systems continue to be viable targets where limited defensive visibility can raise enterprise risk.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
In late 2015, Sofacy used a newer 64-bit non-stripped Fysbis sample that retained similarities to earlier variants but added obfuscation and used mozilla-plugins[.]com as its command-and-control domain. The domain was described as previously unknown and potentially indicative of a newer Sofacy campaign.
In early 2015, Sofacy used a 32-bit stripped ELF Fysbis sample. It installed as /bin/ksysdefd or ~/.config/ksysdef/ksysdefd and beaconed to 198.105.125[.]74 over TCP port 80.
A 64-bit stripped ELF variant of the Fysbis Linux backdoor was used by Sofacy in late 2014. The sample installed as /bin/rsyncd with root or ~/.config/dbus-notifier/dbus-inotifier without root and communicated with azureon-line[.]com over TCP port 80.
Palo Alto Networks publicly analyzed three Fysbis Linux backdoor samples spanning late 2014 through late 2015, linking them to Sofacy infrastructure and documenting the malware's installation, persistence, and command-and-control behavior. The report assessed Fysbis as low in sophistication but operationally effective.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Researchers identified **ACBackdoor**, a cross-platform malware family targeting both **Linux** and **Windows** systems. The backdoor enables arbitrary command execution, binary execution, persistence, host reconnaissance, and malware updates, while both variants communicate with the same HTTPS-based command-and-control infrastructure. Analysis indicated the Linux sample was more sophisticated than the Windows version, suggesting the malware may have been developed for Linux first and later adapted for Windows. The Windows variant was reportedly distributed through **malvertising** tied to the **Fallout Exploit Kit**, which exploited `CVE-2018-15982` and `CVE-2018-8174` to infect victims. Researchers said the Linux delivery method remained unknown, but both versions used platform-specific persistence and masquerading techniques to evade detection and maintain access on compromised hosts.
Aug 14, 2026
Sophos X-Ops reported a limited series of attacks against Sophos Firewall devices in which attackers exploited **`CVE-2022-3236`** and deployed a sophisticated mix of custom and commodity Linux malware. The intrusions included modifications to legitimate SFOS Java and Perl components, most notably a trojanized **`servlet-api-3.1.jar`** that captured administrator credentials, encrypted them, and accepted hidden commands through the **`JSESSIONID`** cookie field, creating a covert backdoor on compromised devices. Investigators identified at least eight malicious file types, including a custom Metasploit JAR, multiple Linux backdoors, a **Termite**-labeled RAT, and **Gh0st RAT** variants that used crafted **ICMP** packets for traffic signaling. The malware enabled file manipulation, shell execution, persistence, encrypted command-and-control, SOCKS proxying, and stealthy communications, indicating a highly capable threat actor focused on maintaining control of firewall appliances while minimizing detection.
Jun 29, 2026