MalwarePublished 15 Aug 2025

Threat Bulletin: Fire in the Woods · A New Variant of FireWood

Source AlienVault OTX General

Description

A new, low-detected variant of the FireWood Linux backdoor has been discovered, showing changes in implementation and configuration while maintaining core functionality. This backdoor, linked to the 'Project Wood' malware lineage, operates as a remote access trojan on Linux systems, using kernel-level rootkit modules and TEA-based encryption for stealth and persistence. The new variant modifies the execution process, alters network communication, and updates file paths. It removes some commands and adds others, including a new 'auto-kill' feature. Samples have been found from Iran and the Philippines, indicating a potentially wide distribution. The backdoor has possible connections to the China-aligned Gelsemium APT group, though this association remains uncertain.

Impact

For European organizations, the presence of a kernel-level Linux backdoor such as this FireWood variant poses significant risks. Many European enterprises and critical infrastructure providers rely on Linux-based servers and network devices, making them potential targets. The stealthy nature of the rootkit and encrypted communications can allow attackers to maintain long-term undetected access, enabling espionage, data exfiltration, and disruption of services. The 'auto-kill' feature could be used to disable security tools, increasing the difficulty of incident response. Given the malware's ability to modify execution and network behaviors, it could be used to pivot within networks, compromising additional systems. The lack of known exploits in the wild suggests this variant may currently be in limited use or testing phases, but its advanced capabilities and ties to a sophisticated APT group indicate a potential for targeted attacks against high-value European targets, including government, defense, telecommunications, and critical infrastructure sectors. The medium severity rating reflects the complexity and stealth of the malware balanced against the current limited distribution and lack of widespread exploitation evidence.

Defensive guidance

European organizations should implement layered, Linux-specific security controls beyond generic advice. Key mitigations include: 1) Deploy kernel integrity monitoring tools that can detect unauthorized rootkit modules and anomalous kernel behavior, such as Linux Kernel Runtime Guard (LKRG) or similar solutions. 2) Use endpoint detection and response (EDR) tools with Linux support capable of detecting unusual process injection, network communication patterns, and file system anomalies. 3) Monitor network traffic for encrypted communications to suspicious external hosts, especially those matching known indicators of compromise (IOCs) such as the provided hashes. 4) Implement strict access controls and multi-factor authentication on Linux servers to reduce the risk of initial compromise. 5) Regularly audit and harden Linux configurations, including disabling unnecessary services and restricting kernel module loading to trusted administrators. 6) Establish threat hunting programs focused on detecting stealthy backdoors and rootkits, leveraging threat intelligence feeds to update detection signatures. 7) Prepare incident response plans specific to kernel-level compromises, including offline forensic analysis capabilities. 8) Collaborate with national cybersecurity centers and share threat intelligence to improve detection and response capabilities against emerging threats like this FireWood variant.

Indicators of compromise

Hashes 12

1900346185266ae49ae893b0b69dfcfd
19bceb587e91a1eae6903b1a633260d8
2251bc7910fe46fd0baf8bc05599bdcf
606fe22545ec46d0934ea0c5f8cb7a68
0cd70432f78a95e0a9b09fe27eb949d39a6d13a1
0fef89711da11c550d3914debc0e663f5d2fb86c
741bc05bc1377dc8034a3f4503a43fbac5232985
7fdf402a0cd9264ba10c1c922b57c617a096e7d1
4c293309a7541edb89e3ec99c4074584328a21309e75a46d0ddb4373652ee0d6
898a5bd86c5d99eb70088a90f1d8f90b03bd38c15a232200538d0601c888acb6

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Aug 2025, 13:03 UTC

MITRE ATT&CK techniques15 from threat tags

Technical details

Indicators of compromise

Hashes 12

Community reviews

Related threats