Back Gbhackers

New SysUpdate Variant Malware Discovered, Decryption Tool for Linux C2 Traffic Released

Gbhackers •Mayura Kathir • February 18, 2026

A new Linux malware sample that strongly aligns with the SysUpdate malware family used by APT27/Iron Tiger. Initially detected on a client’s system, the binary behaved like a system service and executed the GNU/Linux id command when run without specific arguments, returning the output as part of its basic functionality. Closer inspection showed that the sample was […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New SysUpdate Malware Variant Targets Linux with Encrypted C2 Traffic A new variant of SysUpdate malware has been identified, specifically targeting Linux systems with advanced command-and-control (C2) encryption. This malware was discovered during a Digital Forensics and Incident Response engagement, where a suspicious ELF64 executable was found in a client's environment. The malware mimics system service behavior and executes basic commands, indicating its operational capabilities. 3 sources 31

Extracted Entities

New SysUpdate Variant Malware Discovered, Decryption Tool for Linux C2 Traffic Released

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)