Cybersecurity researchers have identified a new Linux backdoor named Plague that poses a serious security threat by allowing attackers to bypass authentication and maintain persistent SSH access on compromised systems. Discovered by Nextron Systems, the malware operates as a malicious Pluggable Authentication Module (PAM), which is a set of shared libraries used for managing user authentication in Linux environments. According to Nextron researcher Pierre-Henri Pezier, 'The implant enables attackers to silently bypass system authentication and gain persistent SSH access.' Despite multiple samples of Plague being uploaded to VirusTotal since July 2024, none of the 66 antivirus engines tested have flagged it as malicious, underscoring its sophisticated evasion capabilities.
The earliest known instance of Plague dates back to July 2024, with the latest variants submitted as recently as March 2025. This indicates that the attackers are actively developing and adapting the malware. The backdoor's stealth features include the ability to erase evidence of SSH sessions by unsetting environment variables and redirecting command history to /dev/null, thereby preventing any audit trails. The malware also employs anti-debugging and string obfuscation techniques to resist analysis, complicating detection efforts.
Technical analysis reveals that Plague exploits PAM's architecture, which allows it to integrate deeply into the authentication stack of Linux systems. This enables credential theft and the ability to bypass authentication checks entirely. Researchers have noted that the presence of multiple compilation artifacts across various Linux distributions, including Debian and Ubuntu, suggests that Plague targets a wide range of environments. 'The malware's design allows it to maintain covert access while avoiding detection by traditional security measures,' stated a Nextron researcher.
In response to the threat, the cybersecurity community is urging organizations to implement robust monitoring and detection measures for their Linux systems. Security teams are advised to audit PAM configurations and monitor for unauthorized changes. As the malware continues to evolve, it remains crucial for organizations to stay informed about emerging threats and to take proactive defensive measures. 'Organizations must prioritize security hygiene to mitigate risks associated with advanced malware like Plague,' said a security analyst. Official guidance on specific patches or mitigation steps has not yet been released, but continuous vigilance is recommended as Plague's presence in the wild raises serious concerns for system integrity and security.