Linux Backdoor Targeting iKuai Routers

MITRE Techniques

• [T1036 ] Masquerading – The backdoor impersonates a legitimate OpenWrt library to blend in with trusted software (‘the ELF impersonates the legitimate libjson_script.so’).
• [T1547.006 ] Boot or Logon Autostart Execution: Kernel Modules and Extensions – The sample uses a library-style filename on Linux to appear as part of system software (‘part of the OpenWrt Project, specifically part of libubox’).
• [T1027 ] Obfuscated Files or Information – Configuration strings are hidden using XOR and encrypted values (‘uses an XOR decryption algorithm with a single byte key’ and ‘the strings decrypted as part of the configuration decryption’).
• [T1573 ] Encrypted Channel – The backdoor sends profiling data and task results over AES-encrypted HTTPS communications (‘This information is AES-encrypted before it is sent’ and ‘sent to the C2 as an encrypted JSON’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – The malware communicates with its C2 over HTTPS endpoints (‘beacons to the C2’ and sends data to ‘https://47.80.111[.]129:7380/cdn-cgi/trace’).
• [T1105 ] Ingress Tool Transfer – It downloads payloads from URLs for execution (‘Downloads payload from a url and executes it as a “scheduled task”’ and ‘__uu__ Downloads, executes, and deletes an ELF’).
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – It executes shell commands through /bin/sh -c (‘Executes shell commands’ and ‘runs shell commands with “/bin/sh -c”’).
• [T1005 ] Data from Local System – It reads local files for exfiltration (‘__dd__ Reads a file, base64 encodes it, and exfiltrates it’).
• [T1021 ] Remote Services – The operator can direct commands remotely through the C2 task loop (‘Enters an infinite loop that beacons to the C2 to receive tasks’).
• [T1053.003 ] Scheduled Task/Job: Cron – The malware supports scheduled execution of downloaded payloads (‘Downloads payload from a url and executes it as a “scheduled task”’ and ‘__sched__’).
• [T1106 ] Native API – It uses system calls and native Linux functions such as chdir() and getpid() to operate (‘Gets the process ID’ and ‘changes directories via chdir()’).