Ankura CTIX FLASH Update - June 14, 2022

Ransomware/Malware Activity

New Evasive Linux Rootkit Activated Using "Magic Packets"

A new Linux rootkit dubbed "Syslogk" has been discovered by Avast security researchers. It was first identified due to its use of an old open-source rootkit known as "Adore-Ng" targeting Linux 2.x and 3.x systems. Rootkit malware is much more complicated to write compared to normal malicious code, meaning that it is typically attributed to highly experienced threat actor developers. Less-sophisticated threat actors are forced to reuse code found in open-source repositories such as GitHub to fill the gap caused by their lack of experience. Syslogk was created before newer Linux versions and thus cannot be run on up-to-date systems. The malware was also linked to the "Rekoobe" malware family, is known for its ability to act as a legitimate SMTP server. This allows the malware to hide as a common, legitimate service that cannot be detected through a simple port scan. Once a