Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

A Look Into Fysbis: Sofacy’s Linux Backdoor

Summary: Unit 42 analyzed three Fysbis ELF binaries used by the Sofacy group (also tracked as APT28 and Sednit), dated late 2014, early 2015 and late 2015, and assessed them as low sophistication but effective. The malware is a modular Linux trojan and backdoor that installs with or without root privileges, and the newest sample introduced a previously unknown command and control domain, mozilla-plugins[.]com, while the older samples beaconed to known Sofacy infrastructure including azureon-line[.]com and 198.105.125[.]74.

Key Takeaway: The newest sample was not stripped and used a rolling double-XOR mask to hide its installation paths and C2 configuration, which is a small step up in obfuscation from the earlier binaries that leaked installation details in clear strings. Most enterprise focus and defender expertise remains on Windows assets, so a low-sophistication Linux backdoor from a Russia-linked espionage group can sit on internet-facing Linux servers and cloud infrastructure with little detection coverage.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related