Intezer discovered a new, low-detected Linux FireWood backdoor variant that retains core RAT functionality but changes implementation details, persistence paths, and command handling while simplifying its beaconing loop. The variant is linked with Project Wood lineage and has low-confidence ties to the Gelsemium APT; known hashes include 898a5bd8…acb6 and d7be3494…78af. #FireWood #ProjectWood
Keypoints
- Intezer identified a new FireWood Linux backdoor variant with implementation and configuration changes while preserving core RAT features and TEA-based encrypted C2 communications.
- The new build removes an early permission gate, splits PID saving and kernel-gating into separate steps, and alters the process-hiding metadata sent to kernel-hide routines.
- Networking/beacon logic was simplified from randomized, multi-stage scheduling to a continuous while(true) connect loop, trading temporal obfuscation for more reliable C2 reachability.
- New and altered file paths for root and non-root persistence locations were introduced (e.g., /usr/lib/.kde-root/ and $HOME/.kde-root/), replacing older rc.local and .bashrc behaviors.
- Command set changed: removed beacon/delay and file-read commands, moved process-hiding command ID, removed HideModule, and added a SetAutoKillEl command; three previously undocumented command IDs (0x109, 0x192, 0x195) were observed.
- IOCs include new-sample SHA256 898a5bd8…acb6, older identical sample d7be3494…78af, and an older VirusTotal submission 4c293309…0d6; an older variant hash cff20753…9263 was also noted.
- Researchers note low-confidence links to China-aligned Gelsemium APT and connection to long-running Project Wood/Operation TooHash lineage dating back to ~2005.
MITRE Techniques
- [T1547] Boot or Logon Autostart Execution – FireWood sets persistence paths for root and non-root users (e.g., /usr/lib/.kde-root/, $HOME/.kde-root/, /etc/init.d/rc.local) to maintain startup execution. Quote: ‘…sets paths for root users as:/usr/lib/.kde-root/…/etc/init.d/rc.local…For non-root users, it uses:$HOME/.kde-root/…$HOME/.bashrc’
- [T1059] Command and Scripting Interpreter – The backdoor enables remote command execution and calls system() to execute retrieved files (command id 0x192). Quote: ‘…Gets a file from the C2 and execute it using the system function.’
- [T1041] Exfiltration Over C2 Channel – FireWood exfiltrates system information, credentials, and files (command id 0x195 handles file exfiltration for specific extensions). Quote: ‘…Exfiltration of files with the following extensions: v2, .k2, .W2, and drive.C2.’
- [T1014] Rootkit – Uses kernel-level rootkit modules (e.g., usbdev.ko) and process-hiding routines to conceal presence. Quote: ‘…employing kernel-level rootkit modules (e.g., usbdev.ko) and TEA-based encryption to hide its presence…’
- [T1573] Encrypted Channel – Communications use TEA-based encryption to communicate covertly with C2 infrastructure. Quote: ‘…TEA-based encryption to hide its presence, maintain persistence, and communicate covertly with its command-and-control infrastructure.’
- [T1105] Ingress Tool Transfer – The backdoor can receive files from C2 (CFileControl::FileUp) and write/execute them on the host (command id 0x192). Quote: ‘…this command calls first ‘CFileControl::FileUp’ to receive the file from the C2.’
- [T1543] Create or Modify System Process – The agent daemonizes, saves PID, and manipulates process metadata (process name, PID, port, hardcoded names) and uses CHideProcess routines to hide itself. Quote: ‘…builds a larger buffer containing the process name, hex-formatted port, PID, a hardcoded “kde-tra” process name…passed through CHideProcess::NetLinkInit()…’
Indicators of Compromise
- [File Hash ] New variant sample – 898a5bd86c5d99eb70088a90f1d8f90b03bd38c15a232200538d0601c888acb6
- [File Hash ] Identical older sample – d7be3494b3e1722eb28f317f3b85ee68bf7ea5508aa2d5782392619e078b78af
- [File Hash ] VirusTotal submission (Iran) – 4c293309a7541edb89e3ec99c4074584328a21309e75a46d0ddb4373652ee0d6
- [File Hash ] Older FireWood variant – cff20753e36a4c942dc4dab5a91fd621a42330e17a89185a5b7262280bcd9263
- [File Paths ] Persistence and module paths – /usr/lib/.kde-root/, $HOME/.kde-root/, /etc/init.d/rc.local, $HOME/.bashrc
Read more: https://intezer.com/blog/threat-bulletin-firewood/