New stealthy Linux malware used to backdoor systems for years

A recently discovered Linux malware with backdoor capabilities has flown under the radar for years, allowing attackers to harvest and exfiltrate sensitive information from compromised devices. 

The backdoor, dubbed RotaJakiro by researchers at Qihoo 360's Network Security Research Lab (360 Netlab), remains undetected by VirusTotal's anti-malware engines, although a sample was first uploaded in 2018.

RotaJakiro is designed to operate as stealthy as possible, encrypting its communication channels using ZLIB compression and AES, XOR, ROTATE encryption.

It also does its best to block malware analysts from dissecting it as resource information found within the sample spotted by 360 Netlab's BotMon system is encrypted using the AES algorithm.

"At the functional level, RotaJakiro first determines whether the user is root or non-root at run time, with different execution policies for different accounts, then decrypts the relevant sensitive resources using AES& ROTATE for subsequent persistence, process guarding and single instance use, and finally establishes communication with C2 and waits for the execution of commands issued by C2," 360 Netlab said.

Linux backdoor used to exfil stolen data

Attackers can use RotaJakiro to exfiltrate system info and sensitive data, manage plugins and files, and execute various plugins on compromised 64-bit Linux devices.

However, 360 Netlab is yet to discover the malware creators' true intent for their malicious tool due to lack of visibility when it comes to the plugins it deploys on infected systems.

"RotaJakiro supports a total of 12 functions, three of which are related to the execution of specific Plugins," the researchers added. "Unfortunately, we have no visibilityto the plugins, and therefore do not know its true purpose."

Since 2018 when the first RotaJakiro sample landed on VirusTotal, 360 Netlab found four different samples uploaded between May 2018 and January 2021, all of them with an impressive total of zero detections.

Command-and-control servers historically used by the malware have domains registered six years ago, in December 2015,  all of them 

360 Netlab researchers also discovered links to the Torii IoT botnet first spotted by malware expert Vesselin Bontchev and analyzed by Avast's Threat Intelligence Team in September 2018.

The two malware strains use the same commands after being deployed on compromised systems, similar construction methods and constants used by both developers.

RotaJakiro and Torii also share multiple functional similarities, including "the use of encryption algorithms to hide sensitive resources, the implementation of a rather old-school style of persistence, structured network traffic."