Kaiji Malware: Anatomy, Persistence and Detection

MITRE Techniques

• [T1110] Brute Force – Initial access from misconfigured SSH with weak password exploited on the honeypot: “Our honeypot has an exposed misconfigured SSH access, with weak password. The threat actors exploited our honeypot and infected it with Kaiji malware.”
• [T1204] User Execution – Malicious PoC exploitation: “this threat actor is targeting security researchers by hiding a malicious backdoor in CVE-2024-6387 proof of concept code, and when running the PoC it will lead to infection of the server with Kaiji malware.”
• [T1569] System Services – Service creation for persistence: “creates a system service … ExecStart=/boot/system.pub” and SysV init scripts (/etc/init.d/dns-udp4) to execute malware at startup.
• [T1053] Scheduled Task/Job – Cron-based persistence: “*/1 * * * * root /.mod >> /etc/crontab” which runs /.mod that calls /usr/lib/libgdi.so.0.8.2.
• [T1543] Create or Modify System Process – Installing init scripts and services across system locations: copies to /lib/system.mark and creates /etc/init.d/x11-common and other init scripts to ensure execution.
• [T1497] Virtualization/Sandbox Evasion (Environment Fingerprinting) – Runtime CPU/environment fingerprinting to adapt behavior: “At runtime it performs CPU/environment fingerprinting.”
• [T1105] Ingress Tool Transfer – Downloading payloads from HTTP file server: “The main payload was downloaded from an Http File Server at 195.177.94.29:26154.”
• [T1071] Application Layer Protocol – C2 over HTTP/HTTPS and WebSocket: “C2 channels over HTTP/HTTPS and WebSocket (TLS-capable).”
• [T1620] Reflective Code Loading / Fileless Techniques – Fileless/stealthy execution patterns and respawn helpers: includes “respawn logic, and dropper helpers such as gateway.sh/system.pub” and techniques to hide artifacts.
• [T1562] Impair Defenses – Modifying SELinux policies to allow malware actions: “ausearch -c ‘system.pub’ –raw | audit2allow -M my-Systemmod; semodule -X 300 -i my-Systemmod.pp” to weaken SELinux.
• [T1036] Masquerading – Use of innocuous-looking filenames for persistence: copies to names like /usr/lib/libgdi.so.0.8.2 and /boot/system.pub to blend in with benign files.
• [T1201] Traffic Signaling – Use of embedded proxies and relays (SOCKS5/HTTP) to proxy malicious traffic: “embedded SOCKS5 and HTTP proxy” used to relay traffic.
• [T1499] Endpoint Denial of Service – DDoS capabilities: “implements a multi-protocol network-attack platform” and “volumetric and protocol-specific DDoS.”
• [T1564] Hide Artifacts – Bind-mounting /tmp over /proc/[pid] to hide process metadata: “mount -o bind /tmp/ /proc/55” to obfuscate process details.
• [T1222] File and Directory Permissions Modification – Dropping executable files into profile.d and altering login scripts to execute malware at login: “/etc/profile.d/bash.cfg … will run at login and execute /etc/profile.d/bash.cfg.”
• [T1592] Gather Victim Network Information – Use of network modules and custom networking for high-throughput traffic and fingerprinting: “custom http/websocket/TLS networking modules” and traffic encoding/buffering.