TeamTNT actors advance Linux-targeting trend with new memory loader

TeamTNT actors advance Linux-targeting trend with new memory loader

Linux-based machines are no longer considered a major deterrent for cybercriminal groups, who are embracing the operating system as a target.(Solo se puede ser libre Cuándo no se tiene nada que perder/phylevn/CC BY 2.0)

Linux-based machines are no longer considered a major deterrent for cybercriminal groups, who are embracing the operating system as a target. This is particularly true when workplaces leverage the cloud to deploy Linux-based containerization technology.


Case in point: researchers are warning that several cyber gangs have started infecting Linux machines via a fileless malware installation technique that until recently was more commonly used against Windows-based systems.


One of the gangs on the forefront of this trend is TeamTNT, which AT&T Alien Labs this week reported is using the new “Ezuri” downloader to decrypt, install and execute a final malware payload from memory, without ever writing to disk.


The Golang language-based downloader is an ELF (Executive and Linkable Format) file that was created back in March 2019 and posted on GitHub. According to a blog post jointly authored by researchers Ofer Caspi and Fernando Marti ..

Support the originator by clicking the read the rest link below.