THE EVOLUTION OF LINUX BINARIES IN TARGETED CLOUD OPERATIONS

Summary from the TLDR InfoSec newsletter

Unit 42 researchers identified five actively evolving Linux ELF malware families (NoodleRAT, Winnti, SSHdInjector, Pygmy Goat, and AcidPour) that threat actors are adapting to target cloud infrastructure, with cloud-based security alerts increasing 388% in 2024. These malware strains use techniques like dynamic linker hijacking and SSH daemon injection to achieve persistence, command and control, and data exfiltration in Linux-based cloud environments that comprise 70-90% of cloud computing instances. Palo Alto Networks' new machine learning detection module successfully identified 92% of tested ELF malware samples, demonstrating the effectiveness of ML-based approaches for detecting these evolving cloud threats.