Sophisticated Quasar Linux RAT Targets Software Developers

Key Points:

• Quasar Linux (QLNX) is a sophisticated Linux RAT targeting software developers, designed to steal developer credentials and access to development tools.
• The malware impacts systems by leveraging multiple persistence mechanisms, including crontab entries and service files, while employing rootkit capabilities to evade detection and conceal its activities.
• Recommended actions include implementing strict access controls, monitoring for unusual process behavior, and conducting regular audits of developer environments to detect potential compromises.

Technical Details: QLNX utilizes a two-tier rootkit architecture with userspace hooks via the LD_PRELOAD shared library and eBPF for kernel-level concealment. It supports 58 commands for extensive interaction with compromised systems.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1053.005 - Scheduled Task/Job: Cron (Persistence)
• T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys (Persistence)
• T1003.001 - OS Credential Dumping: LSASS Memory (Credential Access)
• T1060 - Registry Run Keys (Persistence)

IOCs Mentioned: None mentioned