ESET researchers have discovered a family of malware targeting Linux operating systems. The malware called FontOnLake uses user-defined modules and, according to the malware analysts, is continuously being further developed.
FontOnLake gives hackers remote access to the infected systems and can, for example, collect login data or other confidential information. The location of the C&C server and the affected countries suggest that Southeast Asia is one of the main targets of the attackers. All components are recognized by ESET products as Linux / FontOnLake. The ESET researchers have now published their analysis in a whitepaper on WeliveSecurity.
“FontOnLake is a sophisticated malware program. Due to the low prevalence, we suspect that the malware is being used for targeted attacks, ”says Vladislav Hrčka, the ESET researcher who analyzed this threat. “Companies or individuals who want to protect their Linux endpoints or servers from this threat should use a layered security solution and an up-to-date version of their Linux distribution; some of the examples we analyzed were created specifically for CentOS and Debian. "
Operators act very carefully - only targeted attacks
The first known file from this malware family appeared on VirusTotal in May last year, and more examples were uploaded during the year. None of the C&C servers used in the samples uploaded to VirusTotal were not active at the time of ESET's analysis, indicating that they were disabled as a result of the upload. The researchers of the European IT security manufacturer therefore suspect that the operators of FontOnLake are overly cautious. Almost all of the examples seen by ESET use different, unique C&C servers with different, non-standardized ports. The authors mainly use C / C ++ and various third-party libraries such as Boost, Poco, and Protobuf.
More at ESET on WeLiveSecurity.com
About ESET ESET is a European company with headquarters in Bratislava (Slovakia). ESET has been developing award-winning security software since 1987 that has already helped over 100 million users enjoy secure technology. The broad portfolio of security products covers all common platforms and offers companies and consumers worldwide the perfect balance between performance and proactive protection. The company has a global sales network in over 180 countries and branches in Jena, San Diego, Singapore and Buenos Aires. For more information, visit www.eset.de or follow us on LinkedIn, Facebook and Twitter.