Never-before-seen Linux malware is "more advanced than typical"
arstechnica.com
arstechnica.com
https://research.checkpoint.com/2026/voidlink-the-cloud-nati...
Some kind of opensource ish malware framework the kids are running that can use eBPF …. In addition to limiting CAP_BPF or CAP_SYS_ADMIN you should also take other measures.
Finally, Zig has a user in production /s
(I like Zig, it's a joke, don't hate me)
Is it critical software? Unsure- it will feel critical if it hangs when you’re doing some data processing via a shell its running- but that's besides the point.
Maybe “production” requires it being used for a backend? ;)
Where do I sign up?
That reminds me of the ninjaone interface, they could probably be selling that as a legit management tool, minus the detection avoidance and self-deletion feature :)
--Linux users, probably
Plus no mention of how these machines get "infected". My guess is the admin will need to download something and manually install it. So a root kit ?
I wish these articles would mention how these "most advance malware" gets on your system.
That's good for me, as I develop on a Linux laptop but I never really understood why that is the case. I know that most people are on Windows so B2C malware naturally runs on Windows. However basically all the Internet infrastructure is on Linux and B2B malware should have been targeting that since a long time.
cloud providers monitor internal traffic and can detect a lot of malware activity, so you need stealthier ones
On top of that is the user interactivity model and software distribution model. For most non-admins the various protection schemes on Windows are a choice between "use my computer" and "don't use my computer" and thus basically meaningless. Plus there are fewer centrally managed repos because so much Windows software is hostile to being managed that way and large companies all have to build their own, and small organizations generally give up trying. Quick, hands-off integrity checks on linux can happen in the background and generally won't explode things.
Logging is a factor too. Windows logging tends to be "nothing" or "tsunami" with not a lot in between, and when log monitoring solutions charge by volume and analysts have to comb through oceans of noise to identify potentially dangerous activity, the end result is much less effective watchdogs. I've seen a lot of "Windows -> low cost log monitor doing filtering -> high cost log monitor that people actually look at" due to this, which is obviously harder to manage and less effective.
Most of this can be made the case for Windows, of course, but often isn't because getting Windows into a desired state is such a pain in the ass that it trains people into the "don't touch it, it's working!" mindset. Microsoft was making real strides towards this 20 years ago but their current product management has been security counterproductive IMHO. Doing things in the OS that look a lot like malware turns out to not be a good idea.
When we were developing attacks for unix environments it was often easier to go after the application deployment or CI chains than try to root the box unless there was a juicy SSHD or bash or whatever bug, which have been highly publicized are usually rapidly fixed without needing major effort from endpoint managers.
You forgot mysterious GUID that shows up on exactly one forum post on the Internet with no solution.
Step 1 -> install anti virus protection
Step 2 -> expose yourself to viruses via the protection method
Step 3 -> pay for more virus protection
The infinite flywheel!
come at me bro