RedTail Malware Targets Linux Systems with Multi-Architecture Payloads

• •RedTail malware targets multiple Linux architectures, including ARM and x86-64.
• •It modifies crontabs and firewall rules to establish persistence and evade detection.
• •Dynamic analysis reveals its ability to terminate monitoring tools like strace.

The RedTail malware family has been identified as a multi-architecture threat targeting Linux systems. It employs various attack methods, including process masquerading and establishing persistence through crontab modifications. Dynamic analysis of an x86-64 variant revealed its capability to terminate monitoring processes and create unauthorized network connections. The malware operates over DNS-over-TLS on TCP port 853, complicating detection efforts. Security teams are advised to monitor for suspicious process behavior and implement strict access controls. The malware's deployment package includes architecture-specific executables and scripts for installation and cleanup. Organizations should isolate affected systems immediately upon detection to prevent lateral movement. Current status indicates ongoing analysis and response efforts to mitigate the threat.