Trend Research describes the discovery and technical analysis of GhostPenguin, a previously undocumented multi-threaded Linux backdoor that provides a remote /bin/sh shell and extensive filesystem operations over an RC5-encrypted UDP channel (initial handshake over UDP port 53). The backdoor was found using an AI-driven VirusTotal zero-detection hunting pipeline that decompiled and profiled samples, produced IoCs and hunting queries, and is detectable/blocked by Trend Vision One. #GhostPenguin #TrendVisionOne
Keypoints
- GhostPenguin is a C++ multi-threaded Linux backdoor that implements remote shell functionality and comprehensive file/directory operations over an RC5-encrypted UDP channel, using UDP port 53 for communication.
- The threat was discovered via an AI-augmented hunting pipeline that collected zero-detection VirusTotal samples, extracted artifacts into a structured database, built VirusTotal/YARA hunting queries, decompiled binaries, and applied AI agents (Quick Inspect and Deep Inspector) for scoring and detailed analysis.
- Network comms use a structured session handshake: an initial unencrypted 34-byte request yields a 16-byte session ID from the C2, which becomes the RC5 key for all subsequent encrypted traffic; the malware implements ACKs, retransmit queues, heartbeats, and packet fragmentation to provide reliability over UDP.
- Supported commands include status control, remote shell (fork /bin/sh, send input/output), full filesystem manipulation (list, read, write, create, delete, rename, modify timestamps, search by extension), and directory operations; large transfers are fragmented into multiple UDP packets.
- Analysis indicates active development: leftover debug configuration (unused domain/IP), unused persistence functions, and typos in function/strings (e.g., ImpPresistence, Userame) suggesting immature or evolving code.
- Indicators (hashes, C2 IPs/domains, ports) and hunting queries are provided in the report; Trend Vision One detects and blocks the listed IoCs and offers hunting queries for customer use.
MITRE Techniques
- [None ] No specific MITRE ATT&CK technique IDs or technique names are explicitly listed in the article – (‘MITRE ATT&CK framework mapping’)
Indicators of Compromise
- [SHA-256 ] GhostPenguin binary identifier – 7b75ce1d60d3c38d7eb63627e4d3a8c7e6a0f8f65c70d0b0cc4756aab98e9ab7
- [MD5 ] sample identifier – 7d3bd0d04d3625322459dd9f11cc2ea3
- [SHA1 ] sample identifier – 145da15a33b54e0602e0bbe810ef6c25f2701d50
- [File name ] observed filenames used by the sample – systemd, .temp
- [C2 IPs/domains ] command-and-control servers seen in the report – 65[.]20[.]72[.]101:53, www[.]iytest[.]com:5679, and 1 more (124[.]221[.]109[.]147:5679)
- [Network ports ] ports used for C2 and transport – 53, 5679
Read more: https://www.trendmicro.com/en_us/research/25/l/ghostpenguin.html