The Evolution of Linux Binaries in Targeted Cloud Operations
Summary: Unit 42 researchers report that threat actors are developing Linux ELF binaries - including backdoors, droppers, RATs, wipers and exploit binaries - to target cloud infrastructure, and analyzed five families (NoodleRAT, Winnti, SSHdInjector, Pygmy Goat and AcidPour) that each had at least two significant code updates and at least 20 unique sample sightings in the wild over the past year. The report cites cloud-based alerts rising an average of 388% during 2024 and estimates that 70% to 90% of cloud compute instances run Linux variants, with techniques including LD_PRELOAD dynamic linker hijacking and SSH daemon injection.
Bottom line: With as much as 90% of cloud compute running Linux, the same ELF families tied to China-nexus actors like Starchy Taurus and Digging Taurus and to Russia's Razing Ursa are being actively maintained and sighted at least 20 times each in a year - and AcidPour could wipe unprotected x86 cloud systems given shell access from a web shell or container escape.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026