Researchers at Rapid7 recently reported a cluster of Linux malware targeting telecom and network-edge environments with regionalized process spoofing. The activity involves a dropper that deploys customized builds of BPFDoor, BPF Rekoobe, and a new modular implant tracked as AVERAT. By mimicking legitimate vendor software like the SpamSniper appliance and using covert communication channels such as SMTP and HTTPS POST tunneling, the malware evades standard port scans and deep packet inspection. The attack chain begins when a dropper writes a shell script to the appliance's storage, which then stages payloads as /sbin/ntpdate and /sbin/udevds before deleting them to run filelessly. The dropper re-executes itself as a resident watchdog while AVERAT establishes persistent command and control by beaconing to changeable infrastructure, allowing attackers to relay traffic and maintain access to critical edge devices like embedded CCTV and DVR systems.
Symantec protects you from this threat, identified by the following:
Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
