Quasar Linux (QLNX): A Developer-Targeted Linux RAT and Detection Strategy

MITRE Techniques

• [T1195 ] Supply Chain Compromise – Targets developer and CI/CD hosts to steal repository, package registry, cloud, and signing credentials for later source or build tampering. [‘compromising Linux developer or CI/CD hosts… positioning attackers to alter source code, build pipelines, or published packages’]
• [T1106 ] Native API – Uses memfd_create and execveat directly to launch payloads from memory. [‘directly invokes memfd_create and execveat syscalls to launch payload from an in-memory file descriptor’]
• [T1543.002 ] Create or Modify System Process: Systemd Service – Persists by dropping systemd service files. [‘drops quasar_linux.service under /etc/systemd/system/ and ~/.config/systemd/user/’]
• [T1053.003 ] Scheduled Task/Job: Cron – Installs reboot cron entries for persistence. [‘Installs @reboot cron entries’]
• [T1037.004 ] Boot or Logon Initialization Scripts: RC Scripts – Uses init scripts to start automatically. [‘Drops persistence script at /etc/init.d/quasar_linux’]
• [T1556.003 ] Modify Authentication Process: Pluggable Authentication Modules – Registers malicious PAM modules to intercept logins and sudo credentials. [‘registers pam_security.so / libpam_cache.so in the PAM stack to both backdoor authentication and record cleartext passwords’]
• [T1546.004 ] Event Triggered Execution: Unix Shell Configuration Modification – Adds startup commands to shell config for persistence. [‘Appends startup commands to the user’s .bashrc’]
• [T1547.013 ] Boot or Logon Autostart Execution: XDG Autostart Entries – Uses desktop autostart for logon persistence. [‘Drops quasar_linux.desktop in ~/.config/autostart/ to launch at desktop logon’]
• [T1574.006 ] Hijack Execution Flow: Dynamic Linker Hijacking – Injects its rootkit by writing to ld.so.preload. [‘Adds libsecurity_utils.so.1 to /etc/ld.so.preload so the rootkit is injected system-wide’]
• [T1620 ] Reflective Code Loading – Loads payload from anonymous memory and executes it without a normal file on disk. [‘writes the real payload into an anonymous memfd and executes it via execveat’]
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – Spoofs process names to look like kernel threads. [‘rewrites comm and argv[0] to imitate kernel worker threads such as [kworker/0:0] and [migration/0]’]
• [T1027.004 ] Obfuscated Files or Information: Compile After Delivery – Compiles embedded C source at runtime to evade signatures. [’embeds C source for the rootkit and PAM module inside the implant and compiles it per-host at runtime’]
• [T1014 ] Rootkit – Loads an eBPF-based kernel rootkit compiled against the local kernel. [‘loads an eBPF-based kernel rootkit compiled against the local kernel’]
• [T1070.004 ] Indicator Removal: File Deletion – Removes the original on-disk binary after in-memory launch. [‘Unlinks the original on-disk ELF binary shortly after launching the in-memory copy’]
• [T1070 ] Indicator Removal: Clear Linux or Mac System Logs – Cleans logs after persistence to reduce traces. [‘Log rotation/truncation and journalctl –vacuum operations post-persistence’]
• [T1552.001 ] Unsecured Credentials: Credentials in Files – Harvests tokens and secrets from config and environment files. [‘Walks ~/.npmrc, ~/.pypirc, ~/.aws, ~/.kube, and project-level .env files’]
• [T1552.004 ] Unsecured Credentials: Private Keys – Searches SSH directories for private keys. [‘Walks ~/.ssh to steal SSH private keys’]
• [T1555.003 ] Credentials from Password Stores: Credentials from Web Browsers – Steals browser-stored credentials. [‘Steals browser-stored credentials’]
• [T1083 ] File and Directory Discovery – Enumerates credential-related directories and project trees. [‘Enumerates ~/.ssh, ~/.aws, ~/.kube, and project trees to locate credential material’]
• [T1573.002 ] Encrypted Channel: Asymmetric Cryptography – Wraps its custom C2 in TLS. [‘Wraps the custom C2 protocol in TLS’]
• [T1090.003 ] Proxy: Multi-hop Proxy – Relays operator commands across a peer-to-peer mesh. [‘Establishes a peer-to-peer mesh between infected hosts so operator commands can be relayed through any node’]