Fallout in linux, Aug 17 – Aug 23

What we caught this week while monitoring over 163,309,944 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 23 · 26 catches · 1 wave · 3 singles
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 31d
10fa6bca1274… linux and 8 siblings biggest campaign ✓ 31 days ago

Dropper downloads and executes raw IP payloads

delivery/download-execute
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 31d
k.php linux and 5 siblings ✓ 31 days ago

Webshell, backdoor, C2, persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/persistenceobjectives/credential-accessobjectives/discoveryobjectives/lateral-movementmicro-behaviors/fsobjectivesobjectives/command-and-controlobjectives/exfiltration+4 31d
k.php linux 31 days ago

FreePBX webshell and backdoor

webshell/stagerstealer/file
micro-behaviors/fsmicro-behaviorsmicro-behaviors/communicationsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 31d
s linux ✓ 31 days ago

Multi-arch botnet dropper

delivery/fetch-exec
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/lateral-movementthird_partymicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 31d
k.php linux ✓ 31 days ago

Multi-stage FreePBX webshell dropper

webshell/stageraccount/create

SATURDAY

Sat Aug 22 · 21 catches · 2 waves · 3 singles
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 33d
k.php linux and 4 siblings biggest campaign ✓ 33 days ago

Webshell, backdoor, C2, persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 33d
ok linux and 4 siblings ✓ 33 days ago

Malicious dropper script

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 33d
wr.php linux and 2 siblings ✓ 33 days ago

Multi-stage webshell with root persistence

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/executionmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 33d
ok linux ✓ 33 days ago

Dropper downloads and executes raw-IP payloads

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives/supply-chainmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processmicro-behaviors/cryptoobjectives/command-and-controlobjectives 33d
d96c6de7ab6a… linux ✓ 33 days ago

Botnet dropper with C2 and persistence

botnet/iotdelivery/download
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 33d
ok linux ✓ 33 days ago

Malicious dropper script

delivery/download-execute

FRIDAY

Fri Aug 21 · 4 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives/supply-chainmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processmicro-behaviors/cryptoobjectives/command-and-controlobjectives 33d
d7437869437f… linux ✓ 33 days ago

C2 botnet dropper with persistence

botnet/iotbotnet/network-device
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 33d
wr.php linux ✓ 33 days ago

Multi-stage webshell with root persistence

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectivesobjectives/command-and-controlobjectives/evasion 34d
WSW0 linux ✓ 34 days ago

Dropper downloads and executes remote payloads

cleanup/removedelivery/download-execute

TUESDAY

Tue Aug 18 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 37d
bb36568c1f0a… linux ✓ 37 days ago

Downloads and executes remote payload

delivery/downloadexecution/pipe
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories