Forest Global Training Partners

Cyber Risks · Cisco Talos

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Summary: Cisco Talos documented UAT-10147 deploying SPECTRE, a cross-platform C-written backdoor with a Windows variant carrying 45 commands and a Linux variant carrying 29, both gated by anti-sandbox scoring that self-terminates at 50 points. The Linux build loads a kernel rootkit named Specter disguised as "acpi_pad.ko", persisted via a systemd unit set to run before sysinit.target, while the Windows build downloads RTCore64.sys or DBUtil_2_3.sys to unlink EDR kernel callbacks.

Bottom line: The Linux rootkit hooks six syscall handlers through ftrace, a legitimate kernel debugging interface, so kernel integrity checks see little noise - and its systemd unit starts before any security tooling does. On Windows, a hardcoded offset table covering 13 Windows versions lets the implant blind EDR to every new process, thread, and image load for the rest of the session.

Read the original at Cisco Talos ↗

Topics
Malware
Related