{"id":59128,"date":"2025-08-05T00:01:05","date_gmt":"2025-08-05T00:01:05","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/antivirus-vendors-fail-to-spot-persistent-nasty-stealthy-linux-backdoor\/"},"modified":"2025-08-05T00:01:05","modified_gmt":"2025-08-05T00:01:05","slug":"antivirus-vendors-fail-to-spot-persistent-nasty-stealthy-linux-backdoor","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/antivirus-vendors-fail-to-spot-persistent-nasty-stealthy-linux-backdoor\/","title":{"rendered":"Antivirus vendors fail to spot persistent, nasty, stealthy Linux backdoor"},"content":{"rendered":"

Researchers at German infosec services company Nextron Threat have spotted malware that creates a highly-persistent Linux backdoor and say antivirus engines do not flag the code as malicious.<\/p>\n

Nextron researcher Pierre-Henri Pezier says the company named the malware “Plague” as its deobfuscated code contains the text “Uh. Mr. The Plague, sir? I think we have a hacker” – a line from the 1995 film Hackers.<\/p>\n

\u201cThe implant is built as a malicious PAM (Pluggable Authentication Module), enabling attackers to silently bypass system authentication and gain persistent SSH access,\u201d Pezier wrote<\/a> last week, adding that the malware \u201cintegrates deeply into the authentication stack, survives system updates, and leaves almost no forensic traces. Combined with layered obfuscation and environment tampering, this makes it exceptionally hard to detect using traditional tools.\u201d<\/p>\n