Iptables Backdoor: Even Linux Is At Risk of Intrusion
Summary: Palo Alto Networks' Unit 42 discovered a Linux backdoor implant (md5 b826fb1253a52a3b53afa3b7543d7694) that installs itself as /usr/bin/btdaemon with a startup service at /etc/init.d/bluetoothdaemon, and the sample it caught carried three IP addresses in its config file. The implant connects over UDP ports 53, 80, 110, and 443, sends a string posing as a Linux kernel version, waits for an Auth packet, and executes commands 0-9, including downloading and running an ELF payload named getsetup.rar that can launch SYN or DNS DDoS attacks.
What you should know: The report states the command-and-control IP addresses are currently alive and active, and the implant watches for .IptabLes or .IptabLex processes on the host - meaning a compromised Linux server can be quietly conscripted into DDoS attacks while your existing controls see only ordinary-looking traffic on ports 53 and 443.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026