Monday 16th December 2024

Good morning. If your holiday shopping list includes a budget Android device, you might want to double-check that cart—Germany just uncovered 30,000 malware-laden gadgets hiding in plain sight.

Elsewhere, a crafty WordPress credential heist has security pros and hackers alike reevaluating their trust in free tools, while a Linux rootkit named PUMAKIT proves that even legacy kernels aren’t safe from today’s sophisticated cyber threats.

Consider this your daily reminder that when it comes to cybersecurity, even the pros can get pwned. Enjoy!

Meet PUMAKIT: A New Linux Rootkit in the Wild

Researchers from Elastic Security Labs have uncovered PUMAKIT, a stealthy Linux rootkit capable of hiding files, escalating privileges, and bypassing detection tools. This advanced malware uses a loadable kernel module (LKM) called "PUMA," along with ftrace hooks, to manipulate core system functions without raising alarms.

PUMAKIT operates through a multi-stage architecture involving a dropper, memory-resident executables, and a rootkit. It hooks 18 syscalls and several kernel functions to conceal itself, evade debugging, and establish secure communication with command-and-control (C2) servers.

Key features include:

• Privilege escalation via intercepted syscalls like rmdir().
• Stealth deployment, activating only under specific conditions like kernel symbol availability.
• Anti-debugging and anti-detection mechanisms to evade security tools.

Unlike many modern rootkits, PUMAKIT targets older kernels (pre-5.7) by exploiting functions like kallsyms_lookup_name(). Developers also leveraged fake GPL licensing to bypass restrictions, underscoring its tailored design for legacy Linux systems.

Elastic Security has issued YARA rules to detect its components, but with sophisticated evasion and deployment strategies, PUMAKIT signals a growing threat for Linux environments.

MUT-1244 Exploits Cybersecurity Pros in Massive Credential Heist

In a year-long campaign, a threat actor tracked as MUT-1244 has stolen over 390,000 WordPress credentials, along with SSH private keys and AWS access tokens. Surprisingly, the victims include not only malicious actors but also red teamers, penetration testers, and security researchers.

MUT-1244 used trojanised GitHub repositories offering malicious proof-of-concept (PoC) exploits, luring security professionals into running exploit code. Phishing emails and fake kernel upgrades camouflaged as CPU microcode updates were also used to deliver malware payloads.

Key tactics included:

• Backdoored files: Hidden malware in configure scripts, npm dependencies, Python droppers, and PDFs.
• Exfiltration platforms: Stolen data, including environment variables and credentials, were sent to file-sharing services like Dropbox, with attackers embedding hardcoded credentials for easy access.

MUT-1244 turned a fake WordPress credential-checker tool, “yawpp,” into a honeypot for malicious actors, stealing credentials and compromising their machines. Infected systems often contained sensitive information, giving attackers access to even more networks.

The takeaway: This campaign reveals the double-edged sword of the security community’s trust. Even trusted tools and repositories require vigilance.

BADBOX Malware Disrupted: Pre-Loaded Threat Hits Thousands of Devices

Germany’s Federal Office of Information Security (BSI) has cracked down on BADBOX, a malware operation pre-installed on over 30,000 Android-powered devices sold across the country. These infected gadgets, including digital picture frames, media players, and low-cost phones, came with outdated Android versions and malware baked into their supply chain.

BADBOX's malware, Triada, exploited weak supply chain links to turn cheap, off-brand Android devices into a Swiss Army knife of cybercrime:

• Data theft: Collected sensitive data like authentication codes.
• Ad fraud: Drove fake impressions via a botnet called PEACHPIT, spoofing popular apps and generating fraudulent ad traffic.
• Proxy services: Allowed attackers to route malicious traffic and create fake accounts for platforms like Gmail and WhatsApp.

BSI severed BADBOX’s command-and-control servers by sinkholing domains linked to the operation. Internet providers were instructed to redirect traffic, cutting off the devices' communication with the malware network.

BADBOX’s origin, traced to China, highlights vulnerabilities in global supply chains for tech products. To protect themselves, users with potentially compromised devices are urged to disconnect them immediately.