Researchers Detail QLNX Linux RAT With Rootkit, PAM Backdoor and Developer Credential Theft

May 4, 2026 · Original article ↗

Summary

Trend Micro analyzes QLNX, a previously undocumented Linux RAT that uses stealth, multiple persistence methods, rootkit and PAM backdoor capabilities, and credential harvesting to target developer and cloud access.

Key points

QLNX can run filelessly, spoof its process name, and persist through systemd, cron, init scripts, autostart files, shell configuration, and LD_PRELOAD.
Its user-space LD_PRELOAD and eBPF capabilities can hide processes, files, and network ports.
The malware harvests developer and cloud credentials, including NPM, PyPI, GitHub, AWS, Kubernetes, Docker, and Terraform secrets, as well as SSH keys and browser data.
PAM backdoors can intercept authentication credentials; one implementation supports a hardcoded master-password bypass.
QLNX supports remote shell access, file operations, keylogging, screenshots, tunneling, process injection, and a peer-to-peer mesh.
It communicates over custom TCP/TLS, HTTPS, or HTTP and supports 58 command handlers.
The article provides indicators of compromise and hunting queries; Trend Micro says its platform detects and blocks the listed indicators.

Article Details

Attack Vectors: QLNX executes from an anonymous memory-backed file, deletes its original binary, and can load shared objects directly from memory.
The malware persists through systemd services, crontab entries, init.d scripts, XDG autostart files, .bashrc modification, and /etc/ld.so.preload.
QLNX uses LD_PRELOAD hooks, PAM backdoors, and an eBPF map controller to intercept authentication and hide processes, files, or network ports.
The malware harvests SSH keys, browser data, cloud and developer credentials, shell history, clipboard contents, and /etc/shadow when running as root, then sends collected data to its C&C.
QLNX supports shell execution, payload downloads, process injection using ptrace or /proc/pid/mem, keylogging, screenshots, port scanning, SSH-based lateral movement, and TCP tunneling.
QLNX communicates over custom TCP/TLS, HTTPS, or HTTP and can relay C&C traffic through a peer-to-peer mesh.
Defensive Notes: Trend Micro states that Trend Vision One detects and blocks the specific indicators documented in the article.
The article says Trend Vision One customers can use the Search App and related hunting queries to search for QLNX indicators in their environments.

Indicators of compromise

Type	Indicator	Context
MD5	`70f70743f287a837d17c56933152a8a6`	MD5 hash identified for the QLNX quasar-implant malware sample.
SHA1	`b0f2c668cbdd63a871c90592b6c93e931115872e`	SHA1 hash identified for the QLNX quasar-implant malware sample.
SHA256	`417430b2d4ae8d005224a9ff5dcb4007d452338acbcbcbb62c4e8ed1a70552dd`	SHA256 hash listed for the QLNX PAM credential hook module libpam_cache.so.
SHA256	`42d0c420eb5fe181388f2e4f0b7d7c0d302971e7a06fdc1bec481b68c8ccae1f`	SHA256 hash listed for the QLNX PAM backdoor module pam_security.so.
SHA256	`82daa93219ba40a6e41cdf3174ba57eb5d3383d1cd805584e9954eb0200182a1`	SHA256 hash listed for the QLNX LD_PRELOAD rootkit module libsecurity_utils.so.1.
SHA256	`c99cf0dc1ef1057d713cb082acaf42e4df4656809c91741752bddcab39bbfaca`	SHA256 hash listed for the QLNX rootkit source artifact hide_src_39ZzHo.c.
SHA256	`d55549d5655e2f202e215676f4bdb0994ea08a93d15ec4ded413f64cfa7facc8`	SHA256 hash listed for the QLNX PAM hook source artifact pcs_a3kf9x.c.
SHA256	`ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545`	SHA256 hash identified for the QLNX quasar-implant malware sample.
SHA256	`ea89caab82181881d971be312412795051f6322b105c8b9d29cfb5729fab8d33`	SHA256 hash listed for the QLNX PAM backdoor source artifact pam_src_51YyC3.c.