Reptile Rootkit employed in attacks against Linux systems in South Korea
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41328 | Path Traversal in Fortinet FortiOS Exploited in Targeted Attacks CVE-2022-41328 is a path traversal flaw (CWE-22) in Fortinet FortiOS in which the system fails to properly limit file paths, allowing crafted CLI commands to escape the restricted directory. A privileged attacker — one who already has CLI access to the device — can issue these crafted commands to read and write arbitrary files on the underlying Linux system, effectively breaking out of the FortiOS CLI sandbox. That post-compromise capability is valuable for stealth and persistence, since changes to system files on the underlying OS may not be visible through normal FortiOS administration. Organizations running FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, or any release before 6.4.11 are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-14, carries a high EPSS score (10.7% probability of exploitation within 30 days, 96th percentile), and public reporting describes its use in targeted cyberattacks on government entities attributed to the espionage group tracked as UNC3886, though no public proof-of-concept code is known. Do: Upgrade all affected FortiGate/FortiOS devices to a fixed release beyond the affected ranges — 7.2.4 or later, 7.0.10 or later, or 6.4.11 or later — per Fortinet's advisory, as required by the CISA KEV entry. Restrict privileged CLI access (admin accounts, trusted-host/local-in policies) and review CLI logs plus the underlying Linux filesystem for unexpected file changes as signs of compromise, particularly on government or otherwise high-value networks given UNC3886 targeting. | 7.1 | 11% | KEV |
| masshundreds of thousands of FortiGate deployments (well over 100,000 internet-facing FortiGates appear in public scans) |
Full article400 words · extracted from securityaffairs.com · click to collapse
Researchers observed threat actors that are using an open-source rootkit called Reptile in attacks aimed at systems in South Korea.
Reptile is an open-source kernel module rootkit that was designed to target Linux systems, unlike other rootkits, it also offers a reverse shell. The malware supports port knocking, it opens a specific port on an infected system and waits for a Magic Packet sent by the attackers to establish a C2 connection.
Researchers from the AhnLab Security Emergency Response Center (ASEC) reported that threat actors are using Reptile to target Linux systems in South Korea.
The researchers observed multiple campaigns leveraging Reptile since 2022.
Recently Mandiant published a report about a campaign attributed to a China-linked APT group that used the Reptile rootkit and exploited the zero-day vulnerability (CVE-2022-41328) in Fortinet products. Researchers from ExaTrack also detailed a campaign using the Mélofée malware and the Reptile rootkit. The researchers attributed the campaign to the China-linked cyberespionage group Winnti.
The Reptile malware uses a loader that is a kernel module packed using the open-source tool kmatryoshka.
The tool is used to decrypt the rootkit and load its kernel module into memory. Then the kernel module opens a specific port and awaits for the attacker communications.
Reptile relies on an engine called KHOOK to hook Linux kernel functions. The rootkit was employed in past attacks against South Korean companies.
“The initial method of infiltration remains unidentified, but upon examination, the Reptile rootkit, reverse shell, Cmd, and startup script were all included, allowing the basic configuration to be ascertained.” states the report from ASEC. “In this particular attack case, apart from Reptile, an ICMP-based shell called ISH was also utilized by the threat actor. ISH is a malware strain that uses the ICMP protocol to provide the threat actor with a shell. Typically, reverse shells or bind shells use protocols like TCP or HTTP, but it is speculated that the threat actor opted for ISH to evade network detection caused by these communication protocols.”
Researchers warn that Reptile can be easily utilized by various threat actors because its code is available as open-source. Threat actor can also customize the rootkit in future attacks and use it in conjunction with other malware.
The report also includes Indicators of Compromise (IOCs) for this threat
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, rootkit)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/149203/malware/reptile-rootkit-south-korea.html