Chinese hackers have unleashed a never-before-seen Linux backdoor
arstechnica.com
SprySOCKS borrows from open source Windows malware and adds new tricks.
  • AutoTL;DRBEnglish
    2•7 months ago

    This is the best summary I could come up with:

    Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass.

    In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021.

    The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation.

    The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component.

    Besides showing interest in espionage activities, Earth Lusca seems financially motivated, with sights set on gambling and cryptocurrency companies.

    Monday’s Trend Micro report provides IP addresses, file hashes, and other evidence that people can use to determine if they’ve been compromised.

    The original article contains 537 words, the summary contains 143 words. Saved 73%. I’m a bot and I’m open source!