“Stealthy Plague Malware Targets Linux Servers to Establish Lasting SSH Access”

An advanced Linux backdoor called Plague has surfaced as an unparalleled risk to corporate security, evading recognition by all primary antivirus software while securing persistent SSH access through manipulation of essential authentication processes.

Identified by cybersecurity experts at Nextron Systems, this malware signifies a significant transformation in attacks targeting Linux, exploiting Pluggable Authentication Modules (PAM) to achieve nearly perfect stealth and enduring access to the system.

The malware’s most troubling feature is its total invisibility to standard security systems. Despite numerous variants being submitted to VirusTotal in the past year, no antivirus engines have flagged any samples as harmful, achieving an impeccable 0/66 detection rate.

This extraordinary evasion capability arises from its incorporation into Linux’s core authentication framework, where it functions as a legitimate PAM module while undermining security measures.

Plague Malware Evasion Techniques

Plague utilizes a multi-tiered strategy that merges sophisticated obfuscation with system-level manipulation. The malware employs evolving string obfuscation methods that have advanced from simple XOR-based encryption to complex multi-stage algorithms featuring Key Scheduling Algorithm (KSA), Pseudo-Random Generation Algorithm (PRGA), and Deterministic Random Bit Generator (DRBG) layers. This evolution reflects continuous enhancements by threat actors to remain ahead of analysis mechanisms.

The malware’s antidebug techniques ensure that the binary retains its expected filename libselinux.so.8 and checks for the absence of ld.so.preload in environment variables.

These verifications allow the malware to identify sandbox environments and debuggers that frequently rename binaries or employ preloading techniques for analysis, as reported by Nextron report.

Such strategies align with established antidebug practices where malware examines execution environment integrity before enabling harmful functions.

String encryption is a vital facet of Plague’s stealth capabilities. Initial samples employed basic XOR processes, where each byte underwent bitwise exclusive-or with a designated key.

Nonetheless, recent variants have embraced RC4-like implementations featuring customized KSA and PRGA routines. The KSA phase sets up a 256-byte state array through key-dependent permutations, whereas PRGA generates a pseudorandom keystream for decrypting obfuscated strings in real time.

Plague maintains persistence by masquerading as a legitimate PAM module, specifically targeting the pam_sm_authenticate() function accountable for confirming user credentials.

This strategy exploits PAM’s modular design, where authentication operations load shared libraries dynamically according to configuration files in /etc/pam.d/. By situating itself within this reliable execution pathway, Plague gains access to plaintext credentials and authentication decisions.

The malware applies static password authentication, allowing intruders to bypass standard credential checks through hardcoded backdoor passwords.

This method resembles documented PAM backdoor strategies where malicious modules return PAM_SUCCESS unconditionally for certain credential combinations. The implant’s inclusion into the authentication hierarchy guarantees it endures system updates and functions with elevated rights typical of authentication processes.

Plague demonstrates a high level of understanding of Linux forensic artifacts through intricate session stealth methods. The malware systematically eliminates evidence of SSH sessions by unsetting crucial environment variables, including SSH_CONNECTION, SSH_CLIENT, and SSH_TTY.

Such variables usually hold connection metadata such as client IP addresses, ports, and terminal data that system administrators rely on for auditing.

Moreover, Plague redirects the HISTFILE environment variable to /dev/null, effectively hindering shell command history from being recorded.

This approach guarantees that intruder actions leave no trace in bash history files, which are typically scrutinized during incident response. The malware’s awareness of Linux forensic protocols indicates development by actors with substantial expertise.