Recently, cybersecurity experts have noticed a concerning threat to Linux servers worldwide. Known as DinodasRAT (also referred to as XDealer), this malicious software has been identified targeting systems running Red Hat and Ubuntu operating systems. The campaign, suspected to have been operational since 2022, signifies a growing concern for server security.
While the Linux variant of DinodasRAT has been detected, details about its operation remain limited. However, previous versions have been traced back to 2021, indicating a persistent threat. Notably, DinodasRAT has previously targeted Windows systems in a campaign dubbed 'Operation Jacana,' focusing on governmental entities.
Trend Micro reported on the activities of a Chinese APT group identified as 'Earth Krahang,' utilising XDealer to breach both Windows and Linux systems of governmental organisations globally. This revelation underlines the severity and scope of the threat posed by DinodasRAT.
According to insights provided by Kaspersky researchers, the Linux version of DinodasRAT exhibits sophisticated behaviour upon execution. It establishes persistence on the infected device through SystemV or SystemD startup scripts and creates a hidden file acting as a mutex to prevent multiple instances from running simultaneously. Furthermore, the malware communicates with a command and control (C2) server via TCP or UDP, ensuring secure data exchange through encryption algorithms.
DinodasRAT possesses a range of capabilities designed to monitor, control, and exfiltrate data from compromised systems. These include tracking user activities, executing commands from the C2 server, managing processes and services, offering remote access to the attacker, proxying communications, downloading updates, and self-uninstallation to erase traces of its presence.
Kaspersky researchers emphasise that DinodasRAT provides threat actors with complete control over compromised systems, enabling data exfiltration and espionage. The malware primarily targets Linux servers, with affected victims identified in China, Taiwan, Turkey, and Uzbekistan since October 2023.
Despite the severity of the threat, details regarding the initial infection method remain undisclosed. Nevertheless, the sudden rise of DinodasRAT underscores the insistence on robust cybersecurity measures, especially for organisations relying on Linux servers for critical operations.
As cybersecurity experts continue to monitor and analyse this surge in upcoming threats, proactive measures such as regular system updates, network monitoring, and employee training on security best practices become increasingly crucial in safeguarding against sophisticated threats like DinodasRAT.
