{"id":48357,"date":"2022-09-08T00:00:00","date_gmt":"2022-09-08T00:00:00","guid":{"rendered":"urn:uuid:c08bfba1-2f89-661b-2fc3-2551e3dfa638"},"modified":"2022-09-08T00:00:00","modified_gmt":"2022-09-08T00:00:00","slug":"how-malicious-actors-abuse-native-linux-tools-in-attacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/","title":{"rendered":"How Malicious Actors Abuse Native Linux Tools in Attacks"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/22\/linux-tools-cover-641.jpg\"><\/p>\n<div><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/22\/linux-tools-cover-641.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<div readability=\"43\">\n<div readability=\"31\">\n<p>Based on real-world attacks and our honeypots, we observed that malicious actors use a variety of enabled tools that come bundled with Linux distributions, such as curl, wget, chmod, chattr, ssh, base64, chroot, crontab, ps, and pkill, that are abused by attackers for nefarious purposes.<\/p>\n<p>We have seen malicious actors abusing these tools in the wild. The presence of these utilities, especially inside container environments, should be at least considered, since they provide additional avenues for attackers.<\/p>\n<p>Let\u2019s examine some real-world attacks and instances of abuse that we observed via Trend Micro Cloud One\u2122 and Vision One.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"27.368421052632\">\n<div readability=\"8.4210526315789\">\n<p>The base64 tool is a Linux utility that decodes strings encoded in base64 format. Attackers often obfuscate their payloads and commands using base64 encoding to evade detection (<a href=\"https:\/\/attack.mitre.org\/techniques\/T1027\/\">T1027<\/a>), a technique we describe in detail in our previous article <a href=\"https:\/\/www.trendmicro.com\/pl_pl\/research\/20\/i\/the-evolution-of-malicious-shell-scripts.html\">The Evolution of Malicious Shell Scripts<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"27.218085106383\">\n<div readability=\"10.406914893617\">\n<p>The .bash history file, which is stored in the user\u2019s home directory, logs the commands executed by users on their bash shell. Attackers have been known to extract information from these files to understand the context of the current environment, as we previously detailed in another article \u2014 &nbsp;<a href=\"https:\/\/www.trendmicro.com\/vinfo\/in\/security\/news\/virtualization-and-cloud\/misconfigured-docker-daemon-api-ports-attacked-for-kinsing-malware-campaign\">Misconfigured Docker Daemon API Ports Attacked for Kinsing Malware Campaign<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"32.569444444444\">\n<div readability=\"11.666666666667\">\n<p>As a part of the enumeration step, the attacker accesses the <i>\/etc\/passwd<\/i> file, which contains a list of the registered users within the environment and shows whether a given user has an associated shell with their login. This information helps the attacker understand the environment and pinpoint users of value. (<a href=\"https:\/\/attack.mitre.org\/techniques\/T1003\/008\">T1003.008<\/a>)<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"31.04347826087\">\n<div readability=\"11.869565217391\">\n<p>The chattr utility is used to alter file and folder attributes to control sudden operations like the deletion and modification of files. The example in Figure 4 shows that the attributes of the <i>\/etc\/crontab<\/i> file has been altered, making the file unsecure. This utility has previously been observed to be abused by TeamTNT, as discussed in our white paper, <a href=\"https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-tracking-the-activities-of-teamTNT.pdf\">Tracking the Activities of TeamTNT<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"33.5\">\n<div readability=\"12\">\n<p>The chmod tool is used to change the file mode and granularize access per user or group. It\u2019s required to execute newly downloaded executables, and, in this case, we see the <i>agettyd<\/i> file at the path <i>\/tmp<\/i> being set with the executable bit.<sub><\/sub><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"31.356271777003\">\n<div readability=\"14.132404181185\">\n<p>A cron job is a utility used to schedule tasks (or jobs). Attackers have been known to abuse cron jobs and modify the \u2018crontab\u2019 to perform execution, persistence, and, at times, privilege escalation techniques (<a href=\"https:\/\/attack.mitre.org\/techniques\/T1053\/003\/\">T1053.003<\/a>). The example in Figure 7 shows the removal of existing cron jobs. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible. Our blog entry, <a href=\"https:\/\/www.trendmicro.com\/en_in\/research\/20\/i\/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html\">War of Linux Cryptocurrency Miners: A Battle for Resources<\/a>, discusses these activities in-depth.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"34.5\">\n<div readability=\"14\">\n<p>The curl, or cURL, utility is used to transfer data across different protocols, such as HTTP, HTTPS, and File Transfer Protocol (FTP). The example in Figure 8 shows that system information such as the OS version and release version is sent as a POST request to the attacker\u2019s infrastructure.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"30.484126984127\">\n<div readability=\"12.37037037037\">\n<p>The kill suite utility is used to send signals to processes and, as illustrated in the example in Figure 10, it sends the SIGKILL signal to the process named \u201ckdevtmpfsi\u201d. We have been observing cryptocurrency miners named <i>kdevtmpfsi<\/i> as early as 2020. Our blog entry, <a href=\"https:\/\/www.trendmicro.com\/en_in\/research\/20\/k\/analysis-of-kinsing-malwares-use-of-rootkit.html\">Analysis of Kinsing Malware&#8217;s Use of Rootkit<\/a>, shows another example of a competing miner being terminated.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"34.065491183879\">\n<div readability=\"13.823677581864\">\n<p>The ps utility is used to view the status of a process. Figure 11 shows the <i>ps aux<\/i> command fetching verbose information about the processes, such as currently running processes, process IDs, and process privileges, on the system. This information can aid attackers in performing discovery-related techniques (<a href=\"https:\/\/attack.mitre.org\/techniques\/T1057\/\">T1057<\/a> \u2013 Process Discovery) and gaining information about the environment they\u2019re in.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"31.440217391304\">\n<div readability=\"9.6739130434783\">\n<p>In Figure 11, we see the rm tool being used to delete the hidden files and folders under the <i>\/tmp<\/i> directory. Attackers can create hidden directories to evade detection by adding \u201c.\u201d before the file or folder name (Hide Artifacts: Hidden Files and Directories &#8211; <a href=\"https:\/\/attack.mitre.org\/techniques\/T1564\/001\/\">T1564.001<\/a>).<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"31.596330275229\">\n<div readability=\"13.54128440367\">\n<p>The ssh utility is the remote client used for accessing systems over Secure Shell (SSH) in a worm-like fashion. In Figure 13, the attacker tries to download the Monero miner (using wget\/curl) and infect the remote machine in which the SSH is being attempted (127.0.0.1). Once attackers mount the underlying host\u2019s file system due to unsecure configuration (for example, privileged containers) of containers, they create new pairs of SSH keys, use it to establish an \u201cssh\u201d session, and<a href=\"https:\/\/www.trendmicro.com\/en_in\/research\/19\/l\/why-running-a-privileged-container-in-docker-is-a-bad-idea.html\"> infect the underlying host with cryptocurrency miners<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"32.423841059603\">\n<div readability=\"12.397350993377\">\n<p>In this example, we see the combined use of different Linux utilities wherein the binary is downloaded, permissions are modified, and then later executed. The executable named \u201crunnable\u201d is a Mirai sample delivered after the exploitation of the Log4shell vulnerability tracked under <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=cve-2021-44228\">CVE-2021-44228<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"53.250844277674\">\n<div readability=\"53.730581613508\">\n<p>Using the Vision One workbench, we see the chroot and base64 utilities being used by an attacker. Note that chroot is used to change the root to the directory supplied (in this case, <i>\/host<\/i>), where the underlying host\u2019s file system is mounted within the container. We explore the weakness posed by this function when granted to a container in our article, &nbsp;<a href=\"https:\/\/www.trendmicro.com\/ru_ru\/research\/19\/l\/why-running-a-privileged-container-in-docker-is-a-bad-idea.html\">Why A Privileged Container in Docker is a Bad Idea<\/a>,<\/p>\n<h2><span class=\"body-subhead-title\"><\/span><\/h2>\n<p>By observing the techniques discussed in the previous section, we see that the attackers can use a set of tools that come bundled with a full-scale operating system. As defenders, it would be safer to have container images that contain only the tools we require, and remove the tools that aren\u2019t needed.<\/p>\n<p>This approach to security can help mitigate risk to a great extent, even against critical vulnerabilities such as Log4Shell. Reducing the number of tools needed for applications to run also reduces the attack surface introduced by the dependency vulnerabilities in open-source libraries and tools. Here enters the concept of distroless images, which are <a href=\"https:\/\/github.com\/GoogleContainerTools\/distroless\">described as<\/a><i> <\/i>images that contain only the application and its runtime dependencies, doing away with the programs you would expect to find in a typical Linux distribution such as package managers and shells.<\/p>\n<p>From a defender&#8217;s perspective, the focus should be on disabling, or rather, disarming the attacker via <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/20\/k\/defense-in-depth-layered-security-in-the-cloud.html\">defense-in-depth strategies<\/a>. While making changes to the system to minimize or even prevent abuse would help, a multilayered approach that leverages multiple security measures would provide the strongest level of security, ideally by combining best practices with effective defense technologies.<\/p>\n<p>For non-containerized environments, Cloud One Workload Security provides the <a href=\"https:\/\/cloudone.trendmicro.com\/docs\/workload-security\/application-control\/\">Application Control<\/a> module, which monitors software changes and allows or blocks them based on the set configuration. It creates a baseline of the existing applications and applies the rules to the new applications that are downloaded and installed. It works based on the SHA256 hash for a binary.<\/p>\n<p>It provides options for users to do the following:<\/p>\n<ol>\n<li>Block unrecognized software until explicitly allowed<\/li>\n<li>Allow unrecognized software until explicitly blocked<\/li>\n<\/ol>\n<p>We download a pre-compiled binary of the nmap network enumeration tool from GitHub using wget on an Ubuntu 20.04 long-term support (LTS ) server. The server was then configured with the Cloud One Workload Security agent running with the Application Control module set to \u2018Block\u2019 mode for unrecognized software. As shown in the Figure 17, the execution was prevented by Application Control.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div readability=\"33.5\">\n<div readability=\"12\">\n<p>With attackers making use of legitimate tools and utilities that are built into the operating system, defenders will need to prioritize how they can set up controls during the different phases of an attack. Minimizing the attack surface by using distroless images in containers and applying preventive controls like Cloud One Workload Security\u2019s Application Control go a long way in slowing down attackers targeting cloud environments. In cases where organizations cannot go with a distroless implementation, \u201cslimmed-down\u201d versions of the same images can also be used to reduce the attack surface and strengthen the security of cloud deployments.&nbsp;<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/i\/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Through our honeypots and telemetry, we were able to observe instances in which malicious actors abused native Linux tools to launch attacks on Linux environments. In this blog entry, we discuss how these utilities were used and provide recommendations on how to minimize their impact. Read More HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":48358,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9546,9510,9520,9509],"class_list":["post-48357","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trendmicro","tag-trend-micro-research-apttargeted-attacks","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-cloud","tag-trend-micro-research-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How Malicious Actors Abuse Native Linux Tools in Attacks 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How Malicious Actors Abuse Native Linux Tools in Attacks 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-08T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/22\/linux-tools-cover-641.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"How Malicious Actors Abuse Native Linux Tools in Attacks\",\"datePublished\":\"2022-09-08T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/\"},\"wordCount\":1309,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg\",\"keywords\":[\"Trend Micro Research : APT&amp;Targeted Attacks\",\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Cloud\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/\",\"name\":\"How Malicious Actors Abuse Native Linux Tools in Attacks 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg\",\"datePublished\":\"2022-09-08T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg\",\"width\":638,\"height\":350},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/how-malicious-actors-abuse-native-linux-tools-in-attacks\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : APT&amp;Targeted Attacks\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-apttargeted-attacks\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How Malicious Actors Abuse Native Linux Tools in Attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How Malicious Actors Abuse Native Linux Tools in Attacks 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/","og_locale":"en_US","og_type":"article","og_title":"How Malicious Actors Abuse Native Linux Tools in Attacks 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-09-08T00:00:00+00:00","og_image":[{"url":"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/22\/linux-tools-cover-641.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"How Malicious Actors Abuse Native Linux Tools in Attacks","datePublished":"2022-09-08T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/"},"wordCount":1309,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/09\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg","keywords":["Trend Micro Research : APT&amp;Targeted Attacks","Trend Micro Research : Articles, News, Reports","Trend Micro Research : Cloud","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/","url":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/","name":"How Malicious Actors Abuse Native Linux Tools in Attacks 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/09\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg","datePublished":"2022-09-08T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/09\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/09\/how-malicious-actors-abuse-native-linux-tools-in-attacks.jpg","width":638,"height":350},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/how-malicious-actors-abuse-native-linux-tools-in-attacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : APT&amp;Targeted Attacks","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-apttargeted-attacks\/"},{"@type":"ListItem","position":3,"name":"How Malicious Actors Abuse Native Linux Tools in Attacks"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=48357"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48357\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/48358"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=48357"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=48357"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=48357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}