On the upside they are helping secure Linux because now the the appropriate action can be taken to prevent this in future.
I'm sure a security patch has already been released. The Linux community normally addresses these things very quickly.
this post was submitted on 19 Sep 2023
221 points (94.0% liked)
Technology
77954 readers
1885 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
I'm all for looking on the bright side but this is a bit much lol
Linux users online tend to get very high and mighty every time another OS has a sucurity bug. But it's a good thing for Linux hehe
There's no actual vuln here is there? It's just a persistent backdoor that hides with some elf and kernel tricks.
Their search turned up a version of the malware with the release number 1.1. The version Trend Micro found was 1.3.6. The multiple versions suggest that the backdoor is currently under development.
They version better than I do at work.
This is the best summary I could come up with:
Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass.
In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021.
The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation.
The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component.
Besides showing interest in espionage activities, Earth Lusca seems financially motivated, with sights set on gambling and cryptocurrency companies.
Monday’s Trend Micro report provides IP addresses, file hashes, and other evidence that people can use to determine if they've been compromised.
The original article contains 537 words, the summary contains 143 words. Saved 73%. I'm a bot and I'm open source!
Great.. guess I'll install windows 10 again