One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 5978437 |
| Date de publication | 2022-07-23 13:55:40 (vue: 2022-07-28 00:05:39) |
| Titre | Lightning Framework: A New Modular Malware for Linux |
| Texte | FortiGuard Labs is aware of the discovery of a new Linux malware variant that is not only complex in design, but modular. Dubbed 'Lightning Framework', the malware consists of various modules for different functionality. At this time, there is no report of Lightning Framework being used or observed in the wild attacks.Why is this Significant?This is significant because Lightning Framework is a previously unknown modular malware for Linux that can download and install different modules (including rootkits) and plugins to a targeted machine. While there are no reports of the malware being used in the wild, it can be safely surmised that the Lightning Framework can be expected and incorporated in real attacks soon.What is Lightning Framework?Lightning Framework is a modular malware that consists of various modules for different functionality.A Lightning Framework infection starts with an installation of the Lightning.Downloader module on the compromised Linux machine. This module connects to its Command-and-Control (C2) server and is used to download other additional and plugins including Lightning.Core. Lightning.Core is the main module of Lightning Framework and is responsible for receiving commands from the C2 server and to execute remote commands. Other modules that are downloaded by Lightning.Downloader are:Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Sshd, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf.According to the Intezer blog the modules: Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf are referenced only in the source and actual files have not been discovered in the wild.Furthermore, to add insult to injury - Lightning Framework can open a SSH backdoor using the Linux.Plugin.Lightning.Sshd plugin upon receiving a remote command.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against available modules and plugins of Lightning Framework:Linux/Agent.PA!trLinux/Agent.B5B5!trLinux/Agent.C492!tr |
| Envoyé | Oui |
| Condensat | according actual add additional against are are:linux attacks available aware b5b5 backdoor because been being blog but c492 can command commands complex compromised connects consists control core coverage design different discovered discovery download downloaded downloader dubbed execute expected files following fortiguard framework framework: framework:linux/agent from functionality furthermore have iftop including incorporated infection injury install installation insult intezer iptraf its labs lightning linux machine main malware modular module modules modules: nethogs new not observed only open other plugin plugins previously provides real receiving referenced remote report reports responsible rootkits safely server significant soon source ssh sshd sshijacker starts status surmised targeted time trlinux/agent unknown upon used using variant various what why wild |
| Tags | Malware |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.