TLDR InfoSec · ATTACKS & VULNERABILITIES
NEW PLAGUE LINUX MALWARE STEALTHILY MAINTAINS SSH ACCESS
Summary from the TLDR InfoSec newsletter
Plague is a stealthy Linux malware that had evaded detection for over a year. It acts as a malicious PAM module, using layered obfuscation techniques and environment tampering to avoid detection. The Plague backdoor also scrubs the `SSH_CONNECTION` and `SSH_CLIENT` environment variables and redirects `HISTFILE` to `/dev/null`.