November 19, 2019 By David Bisson 2 min read

Researchers discovered a new backdoor family called ACBackdoor that is targeting both Linux and Windows systems.

Intezer first found the Linux variant of ACBackdoor on a Romanian-hosted server. Its researchers didn’t uncover any information about the delivery vector used for this version of the backdoor. They had more success with the Windows variant of the malware, however. They discovered that those behind the multiplatform backdoor had enough funding to purchase the Fallout exploit kit and use it to distribute their Windows-based malware via several malvertising campaigns.

Additional analysis revealed that the backdoor was capable of arbitrarily executing shell commands and binaries along with establishing persistence and implementing updates. This deep dive into the malware also revealed that the Linux variant was more sophisticated than and likely written before the Windows version. Intezer explained that this finding could indicate that ACBackdoor’s developers are more comfortable with developing Linux-based malware instead of threats for Windows systems.

Other Recently Discovered Backdoors

ACBackdoor isn’t the only new backdoor that security researchers have recently uncovered. In October 2019, security researcher Patrick Wardle analyzed AppleJeus, a new macOS backdoor developed by the infamous Lazarus APT group.

That was just a few days before ESET revealed that the Winnti Group was using a new backdoor called PortReuse to target organizations in the Asian gaming industry. Less than a month later, Kaspersky Lab unveiled its discovery that the Platinum group had begun using the Titanium backdoor against targets in South and Southeast Asia.

How to Defend Against ACBackdoor

Without a known delivery vector, it’s difficult for security professionals to take steps that can meaningfully protect their organizations against the Linux variant of ACBackdoor. That being said, they can use thoughtful prioritization of known software vulnerabilities to block attacks involving exploit kits like Fallout, including those that distribute the Windows-based version of the backdoor.

Companies should also use security information and event management (SIEM) data to receive context about their vulnerabilities, information that they can then use to craft a remediation strategy.

More from

Autonomous security for cloud in AWS: Harnessing the power of AI for a secure future

3 min read - As the digital world evolves, businesses increasingly rely on cloud solutions to store data, run operations and manage applications. However, with this growth comes the challenge of ensuring that cloud environments remain secure and compliant with ever-changing regulations. This is where the idea of autonomous security for cloud (ASC) comes into play.Security and compliance aren't just technical buzzwords; they are crucial for businesses of all sizes. With data breaches and cyber threats on the rise, having systems that ensure your…

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

4 min read - Nation-state adversaries are changing their approach, pivoting from data destruction to prioritizing stealth and espionage. According to the Microsoft 2023 Digital Defense Report, "nation-state attackers are increasing their investments and launching more sophisticated cyberattacks to evade detection and achieve strategic priorities."These actors pose a critical threat to United States infrastructure and protected data, and compromising either resource could put citizens at risk.Thankfully, there's an upside to these malicious efforts: information. By analyzing nation-state tactics, government agencies and private enterprises are…

6 Principles of Operational Technology Cybersecurity released by joint NSA initiative

4 min read - Today’s critical infrastructure organizations rely on operational technology (OT) to help control and manage the systems and processes required to keep critical services to the public running. However, due to the highly integrated nature of OT deployments, cybersecurity has become a primary concern.On October 2, 2024, the NSA (National Security Agency) released a new CSI titled “Principles of Operational Technology Cybersecurity.” This new guide was created in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD SCSC) to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today