A Linux model of a multi-platform backdoor known as DinodasRAT has been detected within the wild focusing on China, Taiwan, Turkey, and Uzbekistan, new findings from Kaspersky reveal.
DinodasRAT, often known as XDealer, is a C++-based malware that gives the flexibility to reap a variety of delicate information from compromised hosts.
In October 2023, Slovak cybersecurity agency ESET revealed {that a} governmental entity in Guyana has been focused as a part of a cyber espionage marketing campaign dubbed Operation Jacana to deploy the Home windows model of the implant.
Then final week, Pattern Micro detailed a menace exercise cluster it tracks as Earth Krahang and which has shifted to utilizing DinodasRAT since 2023 in its assaults aimed toward a number of authorities entities worldwide.
Using DinodasRAT has been attributed to numerous China-nexus menace actors, together with LuoYu, as soon as once more reflecting the device sharing prevalent amongst hacking crews recognized as appearing on behalf of the nation.
Kaspersky mentioned it found a Linux model of the malware (V10) in early October 2023. Proof gathered to this point exhibits that the primary identified variant (V7) dates again to 2021.
It is primarily designed to focus on Pink Hat-based distributions and Ubuntu Linux. Upon execution, it establishes persistence on the host through the use of SystemV or SystemD startup scripts and periodically contacts a distant server over TCP or UDP to fetch the instructions to be run.
DinodasRAT is provided to carry out file operations, change command-and-control (C2) addresses, enumerate and terminate operating processes, execute shell instructions, obtain a brand new model of the backdoor, and even uninstall itself.
It additionally takes steps to evade detection by debugging and monitoring instruments, and like its Home windows counterpart, makes use of the Tiny Encryption Algorithm (TEA) to encrypt C2 communications.
“DinodasRAT’s main use case is to achieve and preserve entry by way of Linux servers quite than reconnaissance,” Kaspersky mentioned. “The backdoor is absolutely purposeful, granting the operator full management over the contaminated machine, enabling information exfiltration and espionage.”
