Quasar Linux RAT Targets Developers with Advanced Fileless Attacks

• •Quasar Linux (QLNX) targets developers and DevOps with advanced fileless techniques.
• •The malware uses an eBPF rootkit and PAM backdoors to evade detection.
• •Active exploitation of QLNX highlights significant risks to the software supply chain.

Quasar Linux (QLNX) is a newly identified Remote Access Trojan specifically targeting software developers and DevOps engineers. It employs sophisticated techniques such as fileless execution, an eBPF rootkit, and PAM backdoors to infiltrate systems, making detection challenging for traditional security measures. The malware operates primarily in memory, avoiding file storage, which is a common detection vector. Its peer-to-peer command and control (C2) mesh further complicates mitigation efforts. The attacks are indicative of a growing trend in targeting the software supply chain, posing significant risks to organizations reliant on Linux systems. Current reports indicate that the malware is actively being exploited, emphasizing the need for heightened security awareness among affected professionals.