The famous TrickBot malware made a name for itself in 2019 when it started carrying out illegal activities including credential theft, personal information theft, Windows domain infiltration and also acted as a malware dropper.
Until now, TrickBot was known as multipurpose Windows malware with several modules affecting the operating system, but now one of the modules of the TrickBot framework called "Anchor_DNS" has been ported to infect Linux devices. Anchor_DNS typically targets high value systems to steal valuable financial information.
A security researcher named Waylon Barn, stage 2 Security, discovered that Anchor_DNS is ported to a Linux version called "Anchor_Linux". With evolution, the Linux version of the malware can target multiple IoT devices, including routers, VPN devices, and NAS devices running Linux.
As analyzed by Vitali Kremez of Advanced Intel, Anchor_Linux uses the following crontab entry to run every minute once installed:
*/1 * * * * root [filename]Anchor_Linux TrickBot malware
It was discovered that the add-on not only acts as a backdoor to infect Linux devices by removing malware, but also contains a built-in Windows TrickBot executable. Intezer, who found an Anchor_Linux malware sample, says it is a new "lightweight backdoor with the ability to spread to neighboring Windows boxes using svcctl over SMB."
Interestingly, with Anchor_Linux, bad actors can target non-Windows environments and pivot to Windows devices on the same network. Speaking to Bleeping Computer, Kremez said:
"The malware acts as a backdoor persistence tool hidden in the UNIX environment used as a hub for Windows exploitation as well as an unorthodox initial attack vector outside of email phishing. It allows the group to target and infect servers in a UNIX environment (such as routers) and use it to fail over to corporate networks. "
How to check if your system is infected with Anchor_Linux malware?
Security researchers say Linux users can check if Anchor_linux has targeted their system by looking for the "/tmp/Anchor.log" file. If such a file exists, Linux users are recommended to scan the system for the notorious malware.
Security researchers believe that Anchor_Linux is still in its early stages and will continue to evolve, making it more dangerous for systems.
