{"id":48580,"date":"2024-04-01T17:27:19","date_gmt":"2024-04-01T14:27:19","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=48580"},"modified":"2026-03-28T05:31:00","modified_gmt":"2026-03-28T02:31:00","slug":"kaspersky-discovers-dinodasrat-linux-implant-targeting-organizations-worldwide","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-discovers-dinodasrat-linux-implant-targeting-organizations-worldwide\/","title":{"rendered":"Kaspersky discovers\u00a0DinodasRAT Linux implant targeting organizations worldwide"},"content":{"rendered":"\n

1 April 2024<\/p>\n\n\n\n

Kaspersky has\u00a0<\/strong>uncovered<\/strong><\/a>\u00a0a new Linux-targeted DinodasRAT backdoor variant, actively compromising organizations in China, Taiwan, Turkiye, and Uzbekistan since at least October 2023. This variant allows cybercriminals to covertly monitor and control compromised systems, highlighting that\u00a0even Linux’s renowned security is not impervious to threats.<\/strong><\/p>\n\n\n\n

Kaspersky’s Global Research and Analysis Team (GReAT) has\u00a0unveiled<\/a>\u00a0details behind a Linux variant of the multi-platform DinodasRAT backdoor, which has been targeting entities in China, Taiwan, Turkey, and Uzbekistan since October 2023. Discovered during ongoing investigations into suspicious activities, this variant shares code and network indicators with the Windows version previously\u00a0identified<\/a>\u00a0by ESET.<\/p>\n\n\n\n

This Linux variant, developed in C++, is designed to infiltrate Linux infrastructures undetected, demonstrating cybercriminals\u2019 advanced capabilities to exploit even the most secure systems. Upon infection, the malware collects essential information from the host machine to create a unique identifier (UID) without gathering user-specific data, thereby avoiding early detection.<\/p>\n\n\n\n

Once contact with the C2 server is established, the implant stores all local information regarding the victim\u2019s ID, privilege level, and other relevant details in a hidden file named “\/etc\/.netc.conf”. This profile file contains the metadata collected by the backdoor at that time. This RAT empowers the malicious actor to surveil and harvest sensitive data from a target\u2019s computer, as well as take full control over the victim\u2019s machine. The malware is programmed to automatically send the captured data every two minutes and 10 hours.<\/p>\n\n\n\n

All Kaspersky products detect this Linux variant as HEUR:Backdoor.Linux.Dinodas.a.<\/strong><\/p>\n\n\n\n

“Half a year after ESET\u2019s announcement regarding the Windows variant of DinodasRAT, we have uncovered a fully functional Linux version of the malware. This underscores the fact that cybercriminals are continuously developing their tools to evade detection and target more victims. We urge all members of the cybersecurity community to exchange knowledge about the latest findings to ensure the cyber safety of businesses,”<\/em> adds Lisandro Ubiedo, a security expert at Kaspersky\u2019s GReAT (Global Research and Analysis Team).<\/p>\n\n\n\n

Learn more about DinodasRAT versions on\u00a0Securelist.com.<\/a>\u00a0A more detailed analysis is available to customers of Kaspersky\u2019s private\u00a0Threat Intelligence Reports<\/a>.\u00a0<\/p>\n\n\n\n

To protect yourself from threats like DinodasRAT, Kaspersky experts recommend: <\/p>\n\n\n\n