FontOnLake Malware Infects Linux Systems Via Trojanized Utilities

A newly discovered malware family has been infecting Linux systems concealed in legitimate binaries. Dubbed FontOnLake, the threat delivers backdoor and rootkit components.

The malware has a low prevalence in the wild and benefits from an advanced design that allows it to maintain extended persistence on an infected system.

Hiding inside legit utilities

FontOnLake has multiple modules that interact with one another and enable communication with malware operators, stealing sensitive data, and staying hidden on the system.

Researchers at ESET found multiple samples of the malware uploaded to the VirusTotal scanning service throughout last year, the first one appearing in May 2020.

Marked by stealth and sophisticated design, FontOnLake is likely used in targeted attacks by operators that are sufficiently careful to use unique command and control (C2) servers for “almost all samples” and various non-standard ports.

While ESET researchers found that the distribution method for FontOnLake is via trojanized application, they do not know how victims are lured to download the modified binaries.

Also Read: What is Pseudonymisation: 5 Techniques and Its Best Practices

Among the Linux utilities that the threat actor altered to deliver FontOnLake are:

• cat – used to print the content of a file
• kill – lists all running processes
• sftp – secure FTP utility
• sshd – the OpenSSH server process

“All the trojanized files are standard Linux utilities and serve as a persistence method because they are commonly executed on system start-up,” Vladislav Hrčka, malware analyst and reverse engineer at ESET,

Accordind to the researchers, the trojan utilities were likely modified at the source code level, indicating that the threat actor compiled them and replaced the original one.

Apart from carrying the malware, the role of these modified binaries is to load additional payloads, collect information, or execute other malicious actions.

The researchers discovered three custom backdoors written in C++ associated with the FontOnLake malware family, which provide operators remote access to the infected system.

A common function for all three of them is to transfer collected sshd credentials and bash command history to the C2 server. They also use custom heartbeat commands to keep alive the connection to the control server.

Based on open-source rootkit

In a technical report released this week, ESET notes that FontOnLake’s presence on a compromised system is hidden by a rootkit component, which is also responsible for updates and for the delivery of fallback backdoors.

All rootkit samples that ESET found target kernel versions 2.6.32-696.el6.x86_64 and 3.10.0-229.el7.X86_64. The two versions discovered are based on an eight-year old open-source rootkit project called Suterusu and can hide processes, files, themselves, and network connections.

Communication between trojanized apps and the rootkit is through a virtual file that the latter creates. An operator can read or write data to this file and have it exported by the backdoor component.

The researchers believe that the author of FontOnLake is “well versed in cybersecurity” and deactivated the C2 servers used in the samples found on VirusTotal once they learned of the upload.

Also Read: 5 Simple Instructions on How to Access Request Form PDF

A puff of FontOnLake

ESET says that FontOnLake may be the same malware previously analyzed by researchers at Tencent Security Response Center, who associated it with an advanced persistent threat incident.

In a tweet in late August, cybersecurity company Avast announced they found a new Linux malware that uses Suterusu, which they named HCRootkit.

Their description is similar to ESET findings as HCRootkit is delivered by a “backdoored coreutils binary” that also drops a backdoor written in C++.

“The main purpose of the rootkit component is to hide the stage 2 payload and ensure the traffic from the CNC is bypassing the firewall by installing a netfilter hook and redirecting the CNC packets to make it look like the packets are coming from localhost” – Avast

Lacework Labs also published an analysis of HCRootkit, which shares details that seem to confirm that the malware is the same as FontOnLake.