Proxmox VE 7 port 8006 scanning surge and RedTail Linux malware analysis (SANS ISC)

SANS Internet Storm Center reported increased scanning and brute-force activity on port 8006 against unsupported Proxmox VE 7 servers following a Proxmox vulnerability advisory, with no confirmed exploitation of the flaw; in a separate guest diary, SANS…

Both items are SANS Internet Storm Center diaries; the reports contain no conflicting figures between them. Proxmox VE 7 scanning (published 2026-09-09T17:46:24Z): Following a Proxmox advisory about a vulnerability in older releases, SANS observed a bump in scans for port 8006 (the Proxmox VE API) plus additional brute-force traffic. The flaw affects only Proxmox VE version 7, which has been unsupported for a couple of years; no confirmed exploitation of the flaw is reported. Observed activity includes fingerprinting requests to /pve2/images/logo-128.png and brute-force POSTs to /api2/json/access/ticket using root@pam usernames and simple passwords, with POSTs to /api2/extjs/access/ticket also seen. Failed authentication shows 401 status codes in PVE proxy logs, and non-TLS POSTs return 308 redirects. The reports do not identify the advisory by CVE ID. RedTail payload analysis (published 2026-09-10T12:58:10Z; diary titled Wed, Sep 9th): A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. A guest analyst detonated the UPX-packed, statically linked x86-64 sample (SHA-256 given in partial form as 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox. The sample renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket; surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images captured from the hypervisor before and after execution were used for forensics, alongside INetSim, auditd, strace, and tcpdump; a check of /proc/PID/exe can distinguish impostor processes. The reports do not state that RedTail targets Proxmox; Proxmox appears only as the analysis hypervisor.

• Scans target port 8006, the Proxmox VE API, including fingerprinting requests to /pve2/images/logo-128.png (SANS ISC, 2026-09-09).
• Brute-force attempts POST to /api2/json/access/ticket with root@pam usernames and simple passwords; POSTs to /api2/extjs/access/ticket were also observed.
• Failed authentication shows 401 status codes in PVE proxy logs; non-TLS POSTs return 308 redirects.
• The vulnerability affects only unsupported Proxmox VE version 7 (unsupported for a couple of years); no confirmed exploitation of the flaw is reported.
• The Proxmox advisory referenced by SANS is not identified by CVE ID in the reports.
• RedTail ships multi-architecture ELF payloads (ARM, ARM64, i686, RISC-V, x86-64) selected by a deployment script and was captured by a DShield honeypot.
• Analyzed sample: UPX-packed, statically linked x86-64, SHA-256 63be5f38...d35e (partial hash as given), detonated in an isolated Ubuntu 24.04 VM on Proxmox.
• RedTail masquerades as php-fom/php-fpm workers using prctl(PR_SET_NAME), with some surviving processes posing as PostgreSQL-like workers; a /proc/PID/exe check distinguishes impostor processes.