{"id":43346,"date":"2021-10-11T14:22:42","date_gmt":"2021-10-11T14:22:42","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32712\/FontOnLake-Malware-Infects-Linux-Via-Trojanized-Utils.html"},"modified":"2021-10-11T14:22:42","modified_gmt":"2021-10-11T14:22:42","slug":"fontonlake-malware-infects-linux-via-trojanized-utils","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fontonlake-malware-infects-linux-via-trojanized-utils\/","title":{"rendered":"FontOnLake Malware Infects Linux Via Trojanized Utils"},"content":{"rendered":"

\"FontOnLake<\/p>\n

A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components.<\/p>\n

The malware has a low prevalence in the wild and benefits from an advanced design that allows it to maintain extended persistence on an infected system.<\/p>\n

Hiding inside legit utilities<\/h3>\n

FontOnLake has multiple modules that interact with one another and enable communication with malware operators, stealing sensitive data, and staying hidden on the system.<\/p>\n

Researchers at ESET found multiple samples of the malware uploaded to the VirusTotal scanning service throughout last year, the first one appearing in May 2020.<\/p>\n

Marked by stealth and sophisticated design, FontOnLake is likely used in targeted attacks by operators that are sufficiently careful to use unique command and control (C2) servers for \u201calmost all samples\u201d and various non-standard ports.<\/p>\n

While ESET researchers found that the distribution method for FontOnLake is via trojanized application, they do not know how victims are lured to download the modified binaries.<\/p>\n

Among the Linux utilities that the threat actor altered to deliver FontOnLake are:<\/p>\n