Linux Systems Are Becoming Bigger Targets

To prevent Linux exploits, organizations should establish an integrated security approach that extends to the network edge.

Derek Manky, Chief Security Strategist & VP Global Threat Intelligence, FortiGuard Labs

April 6, 2022

3 Min Read
Skull on a digital background
Source: canbedone via Alamy Stock Photo

When it comes to security, there are some low-lying threats that can cause big problems. One important example is malware designed to exploit Linux systems, often in the form of executable and linkable format (ELF) binaries. And, as the Linux footprint continues to expand, so, too, will attacks against it.

Researchers from FortiGuard Labs noted a doubling in the occurrence of ELF and other Linux malware detections during 2021 and a quadrupling of the rate of new Linux malware signatures from the first quarter of last year to the fourth quarter. That's not exactly a meteoric rise, but it's not something to ignore, either.

The Growing Threat to Linux
This kind of growth and spread in variants suggests that Linux malware is gaining prominence in cyber adversaries' arsenal. The most common ELF variant is tied to Muhstik, malware that turns infected machines into bots and is known to exploit vulnerabilities for propagation. One notable Muhstik exploit involved Atlassian Confluence, a popular Web-based corporate team workspace. FortiGuard Labs researchers noted multiple malicious actors targeting this vulnerability, with the goal of downloading a malicious payload that would install a backdoor or miner in a user's network.

FortiGuard researchers also saw botnet activity related to a new variant of RedXOR, malware that targets Linux systems for data exfiltration (and that leapt into our top 10 list last October). Meanwhile, a malicious implementation of the Beacon feature of Cobalt Strike called Vermilion Strike targets Linux systems with remote access capabilities. Log4j is another example of an attack where Linux binaries were used to capitalize on the opportunity of targeting low-lying threats such as Linux.

As the use and integration of Linux expands, we can expect more attacks to surface. For example, cyberattackers are likely to see opportunity in Microsoft's active integration of Windows Subsystem for Linux — a compatibility layer used for running Linux binary executables natively on Windows.

Addressing the Threat
What does all this mean? For one thing, it means the Linux attack surface has been expanded to the network edge. Securing your organization against this new wave of threats requires an integrated approach to security. Point products need to be replaced with security devices designed to operate as a unified solution to consistently protect every user, device, and application with policies that can follow data and transactions. This approach also enables centralized management to ensure that policies are consistently enforced, configurations and updates are promptly delivered, and suspicious events are centrally collected and correlated.

Organizations must act with a sense of urgency to harden their Linux systems and operational technology environments. This includes adding tools designed to protect, detect, and respond to threats in real time, as well as taking a security-first approach before adopting new products and technologies. In addition, behavioral analytics should be deployed to discover and block attacks during initial reconnaissance and probing efforts.

Linux runs the back-end systems of many networks and container-based solutions for Internet of Things devices and mission-critical applications. Until recently, Linux has been largely ignored by cybercriminals, but as the Linux footprint expands, so will attacks against it. Organizations must act now — before this threat becomes a significant problem. Action involves establishing an integrated security approach that extends all the way to the network edge for rapid, early detection and remediation.

About the Author(s)

Derek Manky

Chief Security Strategist & VP Global Threat Intelligence, FortiGuard Labs

As Chief Security Strategist & VP Global Threat Intelligence at FortiGuard Labs, Derek Manky formulates security strategy with more than 15 years of cybersecurity experience. His ultimate goal is to make a positive impact toward the global war on cybercrime. Manky provides thought leadership to the industry, and has presented research and strategy worldwide at premier security conferences. As a cybersecurity expert, his work has included meetings with leading political figures and key policy stakeholders, including law enforcement, who help define the future of cybersecurity. He is actively involved with several global threat intelligence initiatives, including NATO NICP, Interpol Expert Working Group, the Cyber Threat Alliance (CTA) working committee, and FIRST, all in an effort to shape the future of actionable threat intelligence and proactive security strategy.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights