QLNX Linux RAT Targets Developer Workstations with Fileless Execution and Credential Theft
Summary
QLNX is a Linux RAT targeting developer and DevOps systems. The article details its fileless execution, rootkit, PAM backdoor, credential theft, and P2P communications, with detection queries and remediation guidance.
Key points
- QLNX targets Linux developer workstations and CI/CD hosts, seeking credentials that could expose repositories, package registries, and cloud environments.
- It executes payloads from memory, masquerades as kernel threads, and compiles embedded source code at runtime into host-specific rootkit and PAM components.
- The malware can alter /etc/ld.so.preload and PAM configuration, capture passwords, and steal SSH keys, developer tokens, cloud credentials, and other secrets.
- Infected hosts use a TLS-wrapped peer-to-peer mesh to relay operator commands, so isolating only one host may not disrupt the network.
- Suggested detection combines auditd, Unix logs, file-integrity monitoring, and network telemetry to identify in-memory execution, suspicious compilation, system-library injection, PAM changes, and credential files.
- For confirmed infections, the article recommends isolating suspected hosts together and reimaging from a verified clean image; it also advises rotating exposed credentials and auditing code, builds, and package uploads.
Article Details
- Defense Focus
- Detecting and containing QLNX, a Linux RAT, through correlated endpoint, authentication, filesystem, and network telemetry, with full reimaging recommended for confirmed infections.
- Detection Methods
- Hunt for memfd_create events followed by execution from /proc/self/fd, excluding common JVM, Node.js, and Python paths as suggested by the article.
- Detect gcc, cc1, clang, or g++ compiling shared objects into suspicious locations such as /tmp or /dev/fd, especially when output paths or filenames include libsecurity.
- Alert on writes to /etc/ld.so.preload and related dynamic-linker configuration paths.
- Correlate filesystem events for QLNX-associated shared objects, concealed credential logs, and the mutex lock file.
- Monitor EXECVE and PATH events involving /etc/pam.d/ and PAM-related shared objects for authentication-stack tampering.
- Identify processes named like kernel threads that have a userspace parent process or maintain userspace network connections.
- Inspect outbound or lateral TLS traffic for the custom protocol's fixed handshake magic value and mesh communications.
- Correlate suspicious events across process execution, file modifications, authentication, and network telemetry rather than relying on a single alert.
- Data Sources
- Auditd SYSCALL, EXECVE, and PATH events
- Unix default logs, including kernel and syslog messages
- UnixSysmon
- AgentX File Integrity Monitoring
- Network telemetry from Zeek, NDR, or firewall flow logs
- Rule Types
- Guardsix SIEM query syntax
- Auditd event correlation
- File integrity monitoring path watch lists
- Platforms
- Guardsix SIEM
- AgentX FIM
- Defensive Actions
- For hosts with confirmed indicators, wipe and reinstall the operating system from a verified clean image.
- If immediate reimaging is not possible, isolate suspected hosts from the network simultaneously because infected peers can relay commands over a P2P mesh.
- Empty /etc/ld.so.preload as a short-term containment step and remove known QLNX persistence artifacts, including service files, init scripts, autostart entries, cron entries, and .bashrc modifications.
- Preserve the XOR-encrypted credential logs for forensic analysis before deleting them.
- Monitor /etc/ld.so.preload and the listed QLNX artifact paths; alert on changes and, where feasible, block unauthorized modifications with EDR or MAC policy.
- Restrict or remove local C compiler access on production and DevOps hosts where it is not needed.
- Configure auditd to capture memfd_create, execveat, and writes to PAM and dynamic-linker configuration files.
- Rotate exposed credentials, including SSH keys, NPM and PyPI tokens, Git PATs, AWS and Kubernetes credentials, .env secrets, and relevant browser session cookies.
- Segment developer workstations to limit direct east-west connectivity.
- Audit commits, build artifacts, and package registry uploads associated with developer accounts active on compromised hosts.
MITRE ATT&CK
T1014 · RootkitThe article reports QLNX loading an eBPF-based kernel rootkit compiled for the local kernel.T1027.004 · Compile After DeliveryQLNX embeds rootkit and PAM-module C source and compiles it at runtime against local kernel headers.T1036.005 · Match Legitimate Resource Name or LocationQLNX rewrites comm and argv[0] to imitate kernel worker thread names such as [kworker/0:0] and [migration/0].T1037.004 · RC ScriptsThe article reports QLNX dropping a persistence script at /etc/init.d/quasar_linux.T1053.003 · CronThe article reports QLNX installing @reboot cron entries.T1070 · Indicator RemovalThe article reports log rotation or truncation and journalctl --vacuum operations after persistence.T1070.004 · File DeletionQLNX unlinks its original on-disk ELF binary shortly after launching the in-memory copy.T1083 · File and Directory DiscoveryQLNX enumerates credential-related directories and project trees to locate keys and tokens.T1090.003 · Multi-hop ProxyQLNX uses a peer-to-peer mesh among infected hosts to relay operator commands through multiple nodes.T1106 · Native APIQLNX directly invokes memfd_create and execveat to execute its payload from an in-memory file descriptor.T1195 · Supply Chain CompromiseThe article maps QLNX's compromise of developer or CI/CD hosts and theft of credentials that could enable changes to source code, build pipelines, or published packages to Supply Chain Compromise.T1543.002 · Systemd ServiceThe article reports QLNX dropping quasar_linux.service under /etc/systemd/system/ and ~/.config/systemd/user/.T1546.004 · Unix Shell Configuration ModificationThe article reports QLNX appending startup commands to the user's .bashrc.T1547.013 · XDG Autostart EntriesThe article reports QLNX dropping quasar_linux.desktop in ~/.config/autostart/.T1552.001 · Credentials In FilesQLNX harvests tokens and secrets from ~/.npmrc, ~/.pypirc, ~/.aws, ~/.kube, and project-level .env files.T1552.004 · Private KeysQLNX walks ~/.ssh to steal SSH private keys.T1555.003 · Credentials from Web BrowsersThe article reports QLNX stealing browser-stored credentials.T1556.003 · Pluggable Authentication ModulesQLNX registers pam_security.so or libpam_cache.so in the PAM stack to backdoor authentication and capture cleartext passwords.T1573.002 · Asymmetric CryptographyQLNX wraps its custom command-and-control protocol in TLS.T1574.006 · Dynamic Linker HijackingQLNX adds libsecurity_utils.so.1 to /etc/ld.so.preload to load its library into newly spawned processes.T1620 · Reflective Code LoadingQLNX writes its payload to an anonymous memfd and executes it via execveat, leaving no corresponding executable on disk.
People
Malware
Vendors
LogpointYou can use the Configuration for AgentX FIM below by adding it to the ossec.conf in /opt/logpoint/ossec/etc/ossec.conf: Trend MicroRecently identified by researchers at TrendMicro, Quasar Linux (QLNX) is a previously undocumented Linux Remote Access Trojan (RAT) purpose-built to exploit exactly that leverage while remaining almost entirely
Products
Tools
AgentXAgentX File Integrity Monitoring (FIM)auditdAuditdgccBecause the malware compiles its rootkit and PAM modules at runtime against the local kernel headers using the system's own gcc, it adapts to a wide range of kernel versions rather than depending on prebuilt binaries.IBM X-Force ExchangeIoCs, sample hashes, and the embedded source artifacts are covered in standard threat-intel feeds like TrendAI Vision One, IBM X-Force Exchange, and SOC Prime (Active Threat Feed) tracking QLNX.SOC PrimeIoCs, sample hashes, and the embedded source artifacts are covered in standard threat-intel feeds like TrendAI Vision One, IBM X-Force Exchange, and SOC Prime (Active Threat Feed) tracking QLNX.UnixSysmonUnixSysmonZeekNetwork telemetry (Zeek/NDR or firewall flow logs)