Linux Security: Chinese State Hackers May Have Compromised ‘Holy Grail’ Targets Since 2012

Forbes – by Davey Winder

For the best part of the last decade, according to a new report from the BlackBerry research and intelligence team, advanced hackers working in the interests of China have been attacking Linux targets with a lot of success and little to no detection. Hardly problematical, you might think, given that the latest statistics show Linux holds 1.71% of the global desktop operating system market share compared to 77.1% for Windows. That is until you realize that Linux powers 100% of the top 500 supercomputers and, according to the BlackBerry research, 75% of all web servers and major cloud service providers for good measure. In February, U.S. Attorney General William Barr warned of ongoing cyber-threats against business by Chinese state actors, saying that China “employs a multi-prong approach engaging in cyber intrusions co-opting private sector insiders through its intelligence services.”

Decade of Chinese RATs

This new research adds to that concern, claiming that a concerted effort involving five Chinese advanced persistent threat (APT) groups has been focused on the Linux servers that “comprise the backbone of the majority of large data centers responsible for the some of the most sensitive enterprise network operations.” What the researchers found was evidence of a previously undocumented Linux malware toolset being used by these threat actors. A toolset that includes no less than two kernel-level rootkits and three backdoors. A toolset that, the researchers have confirmed, has been actively deployed since March 13, 2012. The Decade of RATs analysis by the BlackBerry researchers links this previously unidentified malware toolkit with one of the largest Linux botnets ever discovered, and concludes that it is “highly probable” that the number of impacted organizations is significant and “the duration of the infections lengthy.”

Chinese threat actor attribution

The researchers are highly confident that the five APT groups involved are made up of civilian contractors working in the interest of the Chinese government. That involvement, however, can be plausibly denied by the government, the report suggests, as tools, techniques and attack infrastructure are shared with few bureaucratic or legal hurdles. The groups are best described as using WINNTI, one of the original Chinese APT groups that is thought to have long-since disbanded, tactics, techniques and procedures (TTPs.)  They target, the researchers say, Red Hat Enterprise, CentOS, and Ubuntu Linux environments “systematically across a wide array of industry verticals,” for cyber espionage and intellectual property theft purposes.

Linux defensive capabilities immature at best, report claims

Linux is not, the report claims, a primary focus of security solutions and defensive coverage within Linux environments is “immature at best” with inadequately utilized endpoint protection or endpoint detection and response products. This has enabled the attackers to use those Linux servers as a “network beachhead for other operations,” according to the BlackBerry researchers. “Security products and services that support Linux,  offerings that might detect and give us insight into a threat like this, are relatively lacking compared to other operating systems,” Eric Cornelius, chief product architect at BlackBerry, says, “and security research about APT use of Linux malware (that also might turn it up) is also relatively sparse.”

https://www.forbes.com/sites/daveywinder/2020/04/07/linux-security-chinese-state-hackers-have-compromised-holy-grail-targets-since-2012/#301b9b652086