cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Quasar Linux Malware Targets Developers With Rootkit and Credential-Stealing Capabilities

· Original article ↗

Summary

Trend Micro describes QLNX, a Linux implant targeting developer and DevOps environments with fileless execution, multiple persistence methods, a dual-layer rootkit, and credential theft. Its deployment scale and attribution are unknown.

Key points

  • Trend Micro says QLNX targets developer and DevOps environments, including npm, PyPI, GitHub, AWS, Docker, and Kubernetes.
  • The implant dynamically compiles rootkit components and PAM backdoor modules on infected hosts.
  • It uses fileless, in-memory execution, deletes its original binary, wipes logs, spoofs process names, and employs multiple persistence mechanisms.
  • Its rootkit combines userland LD_PRELOAD hooks with a kernel-level eBPF component to conceal files, processes, and network information.
  • QLNX includes a 58-command RAT, credential harvesting, keylogging, screenshot capture, tunneling, lateral movement, and process injection.
  • Trend Micro provided IoCs; the article says only four security solutions detected the binary at publication time.
  • Trend Micro reported no specific attacks or attribution, so QLNX's deployment scale and activity remain unclear.

Article Details

Attack Vectors
  • QLNX targets developers’ systems and DevOps environments, including environments associated with npm, PyPI, GitHub, AWS, Docker, and Kubernetes.
  • The implant harvests SSH keys, browser credentials, cloud and developer configurations, /etc/shadow data, and clipboard contents; its PAM backdoors intercept and log plaintext authentication data.
  • QLNX uses LD_PRELOAD, systemd, crontab, init.d scripts, XDG autostart, and .bashrc modification for persistence.
  • Its components include a dual-layer rootkit, process injection using ptrace and /proc/pid/mem, and in-memory execution of payloads.
  • The malware supports SSH-based lateral movement, TCP tunneling, SOCKS proxying, and port scanning.
Defensive Notes
  • Trend Micro provided indicators of compromise to help defenders detect QLNX infections; the article does not include the indicator values.
  • At publication, the article reported that four security solutions detected the QLNX binary as malicious.

MITRE ATT&CK

T1003.008 · /etc/passwd and /etc/shadowThe malware’s credential-harvesting layer collects data from /etc/shadow.T1014 · RootkitQLNX uses a dual-layer rootkit, including an eBPF component that conceals PIDs, file paths, and network ports.T1053.003 · CronQLNX uses crontab as a persistence mechanism.T1055 · Process InjectionThe execution and injection engine injects processes using ptrace and /proc/pid/mem.T1056.001 · KeyloggingThe malware’s surveillance module includes keylogging.T1070.002 · Clear Linux or Mac System LogsThe malware wipes logs to hinder forensic investigation.T1071.001 · Web ProtocolsThe RAT maintains C2 communication over HTTP/S channels.T1113 · Screen CaptureQLNX’s surveillance module captures screenshots.T1543.002 · Systemd ServiceThe article identifies systemd as one of QLNX’s persistence mechanisms.T1546.004 · Unix Shell Configuration ModificationThe malware persists through .bashrc injection.T1546.006 · LC_LOAD_DYLIB AdditionQLNX uses an LD_PRELOAD rootkit that hooks libc functions to hide files, processes, and malware artifacts.T1547.013 · XDG Autostart EntriesThe malware uses XDG autostart for persistence.T1552.004 · Private KeysThe credential-harvesting layer collects SSH keys.T1555.003 · Credentials from Web BrowsersQLNX harvests credentials from browsers.T1556.003 · Pluggable Authentication ModulesQLNX deploys PAM backdoors that intercept and log plaintext authentication data.

Malware

Quasar Linux (QLNX)Quasar Linux (QLNX) is a previously undocumented Linux implant targeting developers’ systems and DevOps environments with a blend of rootkit, backdoor, and credential-stealing capabilities.

Products

AWSTrend Micro analysis shows QLNX compiles rootkit components on the host, runs fileless and in-memory for stealth, and uses multiple persistence mechanisms across npm, PyPI, GitHub, AWS, Docker, and Kubernetes.DockerTrend Micro analysis shows QLNX compiles rootkit components on the host, runs fileless and in-memory for stealth, and uses multiple persistence mechanisms across npm, PyPI, GitHub, AWS, Docker, and Kubernetes.GitHubTrend Micro analysis shows QLNX compiles rootkit components on the host, runs fileless and in-memory for stealth, and uses multiple persistence mechanisms across npm, PyPI, GitHub, AWS, Docker, and Kubernetes.KubernetesTrend Micro analysis shows QLNX compiles rootkit components on the host, runs fileless and in-memory for stealth, and uses multiple persistence mechanisms across npm, PyPI, GitHub, AWS, Docker, and Kubernetes.npmTrend Micro analysis shows QLNX compiles rootkit components on the host, runs fileless and in-memory for stealth, and uses multiple persistence mechanisms across npm, PyPI, GitHub, AWS, Docker, and Kubernetes.PyPITrend Micro analysis shows QLNX compiles rootkit components on the host, runs fileless and in-memory for stealth, and uses multiple persistence mechanisms across npm, PyPI, GitHub, AWS, Docker, and Kubernetes.

Related Articles