Chinese Hackers Attacking Linux Devices With New SSH Backdoor

A new report from FortiGuard Labs reveals that Chinese hackers are actively targeting Linux devices with a sophisticated SSH backdoor dubbed ELF/Sshdinjector.A!tr. This malware, attributed to the DaggerFly espionage group, has been used in the Lunar Peek campaign since mid-November 2024, primarily targeting network appliances and IoT devices. The attack involves several malicious components working […] The post Chinese Hackers Attacking Linux Devices With New SSH Backdoor appeared first on Cyber Security News.

Feb 5, 2025 - 17:38

Chinese Hackers Attacking Linux Devices With New SSH Backdoor

A new report from FortiGuard Labs reveals that Chinese hackers are actively targeting Linux devices with a sophisticated SSH backdoor dubbed ELF/Sshdinjector.A!tr.

This malware, attributed to the DaggerFly espionage group, has been used in the Lunar Peek campaign since mid-November 2024, primarily targeting network appliances and IoT devices.

The attack involves several malicious components working in tandem. The initial entry point is a dropper, which first verifies if it has root privileges.

Experts at Fortinet identified that if the system isn’t already compromised, the dropper deploys a suite of malicious binaries, including a modified SSH library named "libsshd.so" and infected versions of common utilities like "ls", "netstat", and "crond".

Overview of ELF – Sshdinjector (Source – Fortinet)

The "libsshd.so" library is the core of the backdoor, equipped with the capability to communicate with a remote command-and-control (C2) server.

The primary malicious functionality resides within a function named “haha,” which spawns two additional threads from functions “heihei” and “xixi” – all terms signifying laughter in Chinese.

The “xixi” function monitors the "/root/intensify-mm-inject/ xxx" directory and restarts the SSH and Cron daemons if necessary.

The “heihei” function establishes a connection with the hardcoded C2 server at IP address 45.125.64[.]200 on ports 33200 or 33223, awaiting commands.

The malware uses a custom communication protocol with the C2 server, embedding a hard-coded UUID (a273079c-3e0f-4847-a075-b4e1f9549e88) and an identifier (afa8dcd81a854144) in each packet, along with the command response.

The C2 server can issue a variety of commands, including:-

Command Id	Description
1	“SERVER_REQ_BASE_INFO”. Exfiltrates uname, MAC address etc to C2
2	List running services, by listing files in “/etc/ init.d”
3	Reads users from “/etc/ shadow”
4	Lists running process
5	Tests access to “/var/log/ dmesg”
6	Tests access to “/tmp/ fcontr.xml”
7	Lists a given directory
8	File transfer
9	Opens a shell terminal
10	Executes a command in the terminal
11	Unloads and exits the malicious process
12	Removes a file
13	Renames a file
1000	“SERVER_RET_ONLINE_ACK”
0x80000001	Client status change notification. It sends base info, service list, read “/etc/ shadow”.