Threats Tagged 'zero-detection malware'

GhostPenguin is a newly discovered, undocumented Linux backdoor malware identified through AI-driven threat hunting. It is a multi-threaded C++ program that establishes remote shell access and file system manipulation capabilities over an encrypted UDP channel using RC5 encryption. The malware employs a structured handshake and thread synchronization for registration, heartbeat, and command delivery, making it stealthy and evasive. Although still in development with debug artifacts present, GhostPenguin's capabilities include remote shell, file and directory operations, and encrypted communications. No known exploits are currently in the wild, and it was found in zero-detection samples on VirusTotal. The malware targets Linux systems, which are widely used in European enterprises and infrastructure. Detection was enabled by custom YARA rules and AI profiling, highlighting the importance of advanced threat hunting techniques. The threat poses a medium severity risk due to its stealth, remote control features, and potential for lateral movement within networks.

MediumMalwareGermanyFranceNetherlands+5#zero-detection malware#c++#multi-threaded