New Linux Malware Framework Lets Attackers Install Rootkit on Targeted Systems

A never-before-seen Linux malware has been dubbed a “Swiss Army
Knife” for its modular architecture and its capability to install
rootkits.

This previously undetected Linux threat, called
Lightning Framework by Intezer, is equipped with a
plethora of features, making it one of the most intricate
frameworks developed for targeting Linux systems.

“The framework has both passive and active capabilities for
communication with the threat actor, including opening up SSH on an
infected machine, and a polymorphic malleable command and control
configuration,” Intezer researcher Ryan Robinson said^[1]
in a new report published today.

Central to the malware is a downloader (“kbioset”) and a core
(“kkdmflush”) module, the former of which is engineered to retrieve
at least seven different plugins from a remote server that are
subsequently invoked by the core component.

In addition, the downloader is also responsible for establishing
the persistence of the framework’s main module. “The main function
of the downloader module is to fetch the other components and
execute the core module,” Robinson noted.

The core module, for its part, establishes contact with the
command-and-control (C2) server to fetch necessary commands
required to execute the plugins, while also taking care to hide its
own presence in the compromised machine.

Some of the notable commands received from the server enable the
malware to fingerprint the machine, run shell commands, upload
files to the C2 server, write arbitrary data to file, and even
update and remove itself from the infected host.

It further sets up persistence by creating an initialization script^[2]
that’s executed upon system boot, effectively allowing the
downloader to be automatically launched.

“The Lightning Framework is an interesting malware as it is not
common to see such a large framework developed for targeting
Linux,” Robinson pointed out.

The discovery of Lightning Framework makes it the fifth Linux
malware strain to be unearthed in a short period of three months
after BPFDoor^[3], Symbiote^[4], Syslogk^[5], and OrBit^[6].