New Undectable Plague Malware Attacking Linux Servers to Gain ...
A sophisticated Linux backdoor dubbed Plague has emerged as an unprecedented threat to enterprise security, evading detection across all major antivirus engines while establishing persistent SSH access through manipulation of core authentication mechanisms.
A complicated Linux backdoor dubbed Plague has emerged as an unprecedented menace to enterprise safety, evading detection throughout all main antivirus engines whereas establishing persistent SSH entry by manipulation of core authentication mechanisms. Found by cybersecurity researchers at Nextron Methods, this malware represents a paradigm shift in Linux -targeted assaults, exploiting ...
New Plague Backdoor for Linux Hijacks SSH Using Malicious PAM Module
Security researchers at Nextron Systems have discovered a stealthy backdoor for Linux systems, called Plague , that uses a malicious authentication module to silently gain access to servers . The malware targets the Pluggable Authentication Modules (PAM) system, a core part of how Linux handles user logins.
The discovery of Plague highlights the critical vulnerability of foundational system components like PAM to sophisticated attacks. Its ability to persist through system updates while leaving minimal forensic traces demonstrates the evolving threat landscape facing Linux infrastructure.
New Undetectable Plague Malware Targets Linux Servers with ...
A new Linux backdoor dubbed Plague has emerged—and it's rewriting the rules of stealth and persistence in cyberattacks. 🔍 Discovered by researchers at Nextron Systems, Plague hides in plain ...
Undetected for a year, Plague malware targets Linux PAM to hijack SSH access and erase forensic traces.
Overview of New Undectable Plague Malware Attacking Linux Servers To Gain
What Is the Plague Linux Backdoor Malware ? To sum it up, " Plague " is Linux malware disguised as a PAM module. Think of PAM as the decision-maker in your Linux system that controls who gets in and who doesn't. This particular backdoor hooks into PAM so it can bypass normal authentication flows entirely. With Plague installed, attackers can gain persistent SSH access using hardcoded static ...
As part of our ongoing threat hunting efforts, we identified a stealthy Linux backdoor that appears to have gone publicly unnoticed so far. We named it Plague . The implant is built as a malicious PAM (Pluggable Authentication Module), enabling attackers to silently bypass system authentication and gain persistent SSH access. What caught our attention: although several variants of this backdoor ...
New Linux backdoor Plague bypasses auth via malicious PAM module
A stealthy Linux backdoor named Plague , hidden as a malicious PAM module, allows attackers to bypass auth and maintain persistent SSH access.
A malicious PAM module, undetected by VirusTotal, embedded itself in the login process, granting covert access and resisting upgrades.