Fallout in linux, Aug 10 – Aug 16

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 16 · 8 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 39d
wr.php linux and 2 siblings biggest campaign ✓ 39 days ago

Multi-stage webshell with root persistence

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 39d
wr.php linux ✓ 39 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
objectives/anti-staticobjectives/command-and-controlobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 39d
k.php linux ✓ 39 days ago

Root backdoor, C2, data exfil

account/createurl/external-ip
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 39d
k.php linux ✓ 39 days ago

Root backdoor, C2, data exfil

account/createurl/external-ip

SATURDAY

Sat Aug 15 · 21 catches · 1 wave · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 39d
wr.php linux and 4 siblings biggest campaign ✓ 39 days ago

Multi-stage webshell with root persistence

webshell/authaccount/create
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 39d
k.php linux and 3 siblings ✓ 39 days ago

Webshell, backdoor, C2, persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives/evasionmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 39d
ohshit.sh linux ✓ 39 days ago

Dropper with persistence and C2

execution/native-binarydelivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/exfiltrationobjectives/lateral-movementobjectives/command-and-controlobjectivesobjectives/persistence+5 39d
wr.php linux ✓ 39 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 40d
cat.sh linux ✓ 40 days ago

Multi-arch malware dropper

delivery/download-execute

FRIDAY

Fri Aug 14 · 30 catches · 2 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 40d
wr.php linux and 4 siblings biggest campaign ✓ 40 days ago

Webshell, backdoor, root persistence, C2

webshell/authaccount/create
objectives/anti-staticobjectives/command-and-controlobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 40d
k.php linux and 2 siblings ✓ 40 days ago

Root user creation, C2, webshell

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectivesobjectives/command-and-controlobjectives/evasion 40d
WSW0 linux and 2 siblings ✓ 40 days ago

Dropper downloads and executes remote payloads

delivery/download-executecleanup/remove
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 40d
k.php linux ✓ 40 days ago

Root backdoor, C2, data exfil

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectivesobjectives/command-and-control 40d
run.sh linux ✓ 40 days ago

Downloads and executes remote payload

delivery/download
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processmicro-behaviors/osobjectives/command-and-controlobjectives 40d
bd6639401fc3… linux ✓ 40 days ago

Raw IP download and execute dropper

delivery/download-executebotnet/iot

TUESDAY

Tue Aug 11 · 29 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/executionmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 44d
ok linux 44 days ago

Malicious dropper script

delivery/download-execute
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 44d
k.php linux 44 days ago

FreePBX backdoor with root persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/evasion 44d
ok linux 44 days ago

Raw-IP dropper with cleanup

delivery/fetch-execindicator-removal/cleanup

MONDAY

Mon Aug 10 · 43 catches · 3 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 44d
wr.php linux and 5 siblings biggest campaign ✓ 44 days ago

Webshell, backdoor, root persistence, C2

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 44d
ok linux and 2 siblings ✓ 44 days ago

Downloads and executes remote payloads

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 44d
p linux and 2 siblings ✓ 44 days ago

Downloads and executes remote payloads

delivery/download-executedelivery/fetch-exec
micro-behaviors/communicationsmicro-behaviorsobjectives/impactmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 44d
lil linux ✓ 44 days ago

Malware dropper killing rivals and fetching payloads

delivery/download-executedelivery/fetch-exec
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 45d
k.sh linux ✓ 45 days ago

Raw IP dropper execution

delivery/fetch-execdelivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 45d
wr.php linux ✓ 45 days ago

Multi-stage webshell with root persistence

webshell/authaccount/create
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 45d
k.php linux and 3 siblings ✓ 45 days ago

Webshell, backdoor, C2, persistence

account/createurl/external-ip
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories