Ankura CTIX FLASH Update - August 27, 2024

Ransomware/Malware Activity

Linux Malware Uses New Mechanism for Persistence, Evades Detection since 2022

Cybersecurity researchers have discovered a piece of Linux malware that has evaded detection through a novel persistence mechanism for at least two (2) years. The 'sedexp' malware has been deployed by an unknown threat actor with a likely financial motive given the malware was used to hide credit card scraping code on a web server. The malware persists in a victim Linux machine by crafting a 'udev' rule which effectively runs the malware on system restart. udev is a device management system that identifies devices (such as USB drives or storage drives) in the '/dev' directory and allows the configuration of rules to action when there is a change in the device state. The sedexp malware adds a udev rule that effectively runs the malware ("asedexpb") whenever the precondition is met that major and minor numbers match "/dev/random". "/dev/random" is an essential