linux-malware

linux-malware Обновления за последние 7 дней из этого репозитория Предложить? Пресса/академические круги https://en.wikipedia.org/wiki/Linuxmalware 17 — Начальный доступ, Выполнение, Закрепление, Повышение привилегий, Обход защиты, Доступ к учётным данным, Обнаружение, Боковое перемещение, Сбор,...

MalwareSourceCode

vx-underground에서 관리 | 트위터 팔로우 | VXUG/samples 페이지에서 악성코드 샘플 다운로드 책임 면책 조항: 적용 법률이 허용하는 최대 범위 내에서, vx-underground 및/또는 vx-underground에 콘텐츠를 제출한 계열사는 i 귀하의 이 리소스 접근 및/또는 접근 불가능; ii 이 리소스에서 참조하는 제3자의 모든 행위 또는 콘텐츠비방, 공격적, 불법 행위 또는 기타 사용자/제3자의 행위를 포함하되 이에 국한되지 않음; iii 이 리소스에서 얻은 모든 콘텐츠로 인해 발생하는 간접, 부수적...

Limon

Limon - 리눅스 악성코드 분석용 샌드박스 Limon은 파이썬으로 작성된 연구 프로젝트로 개발된 샌드박스로, 리눅스 악성코드의 런타임 지표를 자동으로 수집, 분석 및 보고합니다. 오픈 소스 도구를 사용하여 정적, 동적 및 메모리 분석을 수행함으로써 실행 전, 실행 중, 실행 후사후 분석에 리눅스 악성코드를 검사할 수 있습니다. Limon은 통제된 환경에서 악성코드를 분석하고, 그 활동과 자식 프로세스를 모니터링하여 악성코드의 성격과 목적을 파악합니다. 악성코드의 프로세스 활동, 파일 시스템 및 네트워크와의 상호작용을 확인하...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

yara-rules

yara-rules 최근 악성코드 연구에서 수집한 YARA 시그니처 모음 규칙 모음 Dacls Trojan 규칙: DaclsLinux.yara 규칙: DaclsWindows.yara 참조: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown 규칙: APT32KerrDown.yara 참조: https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/ ACBackdoor ...

Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor

Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. "Showboat is a modular post-exploitation framework designed for Linux systems, capable...

linux-malware-toolbox

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

linux-malwares

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code

The recently discovered sophisticated Linux malware framework known as VoidLink is assessed to have been developed by a single person with assistance from an artificial intelligence AI model. That's according to new findings from Check Point Research, which identified operational security blunder...

New China Linked VoidLink Linux Malware Targets Major Cloud Providers

Researchers have discovered VoidLink, a sophisticated new Linux malware framework designed to infiltrate AWS, Google Cloud, and Azure. Learn how this Chinese-affiliated toolkit uses adaptive stealth to stay hidden...

New Advanced Linux VoidLink Malware Targets Cloud and container Environments

Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term, stealthy access to Linux-based cloud environments According to a new report from Check Point Research, the cloud-native...

China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe. The activity cluster, which has been active since at least 2022, primarily focuses on extensive technical reconnaissance of target organizations...

ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other. Here's a quick rundown of the latest cyber stories that show how fast the game keeps changing...

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

A Pakistan-nexus threat actor has been observed targeting Indian government entities as part of spear-phishing attacks designed to deliver a Golang-based malware known as DeskRAT. The activity, observed in August and September 2025 by Sekoia, has been attributed to Transparent Tribe aka APT36, a...

EUVD-2025-13634

Malicious code in bioql PyPI...

CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems

Cybersecurity researchers have discovered two new malware families, including a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access trojan RAT named ZynorRAT that can target both Windows and Linux systems. According to an analysis from Jamf Threat Labs, ChillyHell is writt...

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell. The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a...

Malicious Go, npm Packages Deliver Cross-Platform Malware, Trigger Remote Data Wipes

Cybersecurity researchers have discovered a set of 11 malicious Go packages that are designed to download additional payloads from remote servers and execute them on both Windows and Linux systems. "At runtime the code silently spawns a shell, pulls a second-stage payload from an interchangeable...

New 'Plague' PAM Backdoor Exposes Critical Linux Systems to Silent Credential Theft

Cybersecurity researchers have flagged a previously undocumented Linux backdoor dubbed Plague that has managed to evade detection for a year. "The implant is built as a malicious PAM Pluggable Authentication Module, enabling attackers to silently bypass system authentication and gain persistent S...