April 13, 2024

Mar 28, 2024NewsroomLinux / Community Safety

Linux Version of DinodasRAT

A Linux model of a multi-platform backdoor referred to as DinodasRAT has been detected within the wild concentrating on China, Taiwan, Turkey, and Uzbekistan, new findings from Kaspersky reveal.

DinodasRAT, also called XDealer, is a C++-based malware that provides the flexibility to reap a variety of delicate knowledge from compromised hosts.

In October 2023, Slovak cybersecurity agency ESET revealed {that a} governmental entity in Guyana has been focused as a part of a cyber espionage marketing campaign dubbed Operation Jacana to deploy the Home windows model of the implant.


Then final week, Pattern Micro detailed a menace exercise cluster it tracks as Earth Krahang and which has shifted to utilizing DinodasRAT since 2023 in its assaults aimed toward a number of authorities entities worldwide.

The usage of DinodasRAT has been attributed to varied China-nexus menace actors, together with LuoYu, as soon as once more reflecting the software sharing prevalent amongst hacking crews recognized as appearing on behalf of the nation.

Linux Version of DinodasRAT

Kaspersky stated it found a Linux model of the malware (V10) in early October 2023. Proof gathered up to now exhibits that the primary identified variant (V7) dates again to 2021.

It is primarily designed to focus on Crimson Hat-based distributions and Ubuntu Linux. Upon execution, it establishes persistence on the host by utilizing SystemV or SystemD startup scripts and periodically contacts a distant server over TCP or UDP to fetch the instructions to be run.


DinodasRAT is provided to carry out file operations, change command-and-control (C2) addresses, enumerate and terminate operating processes, execute shell instructions, obtain a brand new model of the backdoor, and even uninstall itself.

It additionally takes steps to evade detection by debugging and monitoring instruments, and like its Home windows counterpart, makes use of the Tiny Encryption Algorithm (TEA) to encrypt C2 communications.

“DinodasRAT’s main use case is to achieve and preserve entry through Linux servers moderately than reconnaissance,” Kaspersky stated. “The backdoor is absolutely purposeful, granting the operator full management over the contaminated machine, enabling knowledge exfiltration and espionage.”

Discovered this text fascinating? Comply with us on Twitter and LinkedIn to learn extra unique content material we put up.