Fallout in linux, Aug 24 – Aug 30

What we caught this week while monitoring over 163,176,316 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

MONDAY

Mon Aug 24 · 21 catches · 2 waves · 2 singles
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 31d
k.php linux and 6 siblings biggest campaign ✓ 31 days ago

Multi-stage backdoor with C2 and persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 31d
wr.php linux and 5 siblings ✓ 31 days ago

Multi-stage webshell and rootkit

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 31d
1658051c5249… linux and 5 siblings ✓ 31 days ago

Malicious dropper script

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/lateral-movementthird_partymicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 31d
k.php linux ✓ 31 days ago

Multi-stage FreePBX webshell dropper

webshell/stageraccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 31d
wr.php linux ✓ 31 days ago

Webshell, root account creation, C2

webshell/authaccount/create
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories