Researchers from Nextron Systems discovered new malware for Linux that remained undetected for over a year. It allows attackers to maintain persistent access via SSH and bypass authentication on compromised systems.
The malware has been named Plague and is a malicious PAM (Pluggable Authentication Module). It employs multi-layered obfuscation and disguises itself to evade detection by security solutions.
Plague can counteract debugging and analysis, hides its strings and commands, uses hard-coded passwords for covert access, and can also conceal traces of sessions that could reveal the attackers’ activity.
Upon loading, the malware cleans the environment of traces of its activity: it resets environment variables related to SSH and redirects the command history to /dev/null to conceal the action logs, metadata, and erase digital traces from system logs.
“Plague integrates deeply into the authentication stack, can ‘survive’ system updates, and leaves virtually no traces. Combined with obfuscation and environmental modification, this makes Plague almost undetectable by traditional security tools,” says Nextron Systems specialist Pierre-Henri Pezier. “The malware actively cleans the runtime environment to hide SSH sessions. Variables such as SSH_CONNECTION and SSH_CLIENT are removed using unsetenv, and HISTFILE is redirected to /dev/null to avoid logging.”
Upon analyzing the samples, researchers discovered compilation artifacts indicating extensive and active development of the malware using different versions of GCC and for different Linux distributions.
Moreover, although various versions of this malware have been uploaded to VirusTotal over the past year, not a single antivirus engine has detected them as malicious.
“Plague is an advanced and constantly evolving threat for Linux. It uses basic authentication mechanisms to maintain a stealthy and persistent presence in the system,” adds Pezier. “Sophisticated obfuscation, static credentials, and runtime environment manipulation make it virtually invisible to standard security tools.”