Threats Tagged 'terndoor'

Three years after its initial discovery, the Melofee Linux implant has evolved with sophisticated new capabilities. The malware now features modularized architecture with hot-loadable components for shell functionality, file management, and command execution. New versions incorporate remote C2 infrastructure reconfiguration and enhanced stealth through a kernel rootkit based on the Reptile project. The implant uses RC4 encryption and supports multiple communication protocols including TCP, HTTP, HTTPS, and TLS. Analysis reveals two infrastructure clusters utilizing fake certificates impersonating Symantec and other entities. Code similarities establish links with Windows-targeting implants including CrowDoor, Hemigate, and RatelS, suggesting tool sharing among multiple Chinese state-linked threat groups. The modular design allows dynamic loading of up to eleven specialized modules via a common plugin interface.

UAT-9244, a China-nexus advanced persistent threat actor, has been targeting critical telecommunications infrastructure in South America since 2024. The group employs three new malware implants: TernDoor, a Windows-based backdoor variant of CrowDoor; PeerTime, an ELF-based backdoor using BitTorrent protocol; and BruteEntry, a brute force scanner for SSH, Postgres, and Tomcat servers. UAT-9244 uses dynamic-link library side-loading, scheduled tasks, and registry modifications for persistence. The group is closely associated with FamousSparrow and Tropic Trooper, sharing similar tooling and tactics. Their infrastructure includes multiple command and control servers and operational relay boxes for scanning and brute-forcing activities.

MediumMalwareBrazilArgentinaChile+7#crowdoor#telecommunications#apt