Full Report
DaggerFly’s Lunar Peek campaign is using a new malware strain, identified by FortiGuard Labs, to compromise Linux networks
Analysis Summary
# Threat Actor: DaggerFly (Associated)
## Attribution & Identity
The threat activity discussed is linked to the **DaggerFly espionage group**. The specific malware strain discussed is ELF/Sshdinjector.A!tr.
## Activity Summary
The activity is tracked under the **Lunar Peek campaign**. This campaign utilizes the ELF/Sshdinjector.A!tr malware to target Linux-based network appliances with the primary function of data exfiltration.
## Tactics, Techniques & Procedures
- **Execution/Privilege Escalation**: The malware verifies if it has root privileges before proceeding.
- **Defense Evasion**: Checks for an existing infection using a specific file (/bin/lsxxxssswwdd11vv containing "WATERDROP").
- **Persistence**: Overwrites legitimate system binaries like `ls`, `netstat`, and `crond` with infected versions.
- **Command and Control**: Uses a modified SSH library (`libsshd.so`) to communicate with C2 servers.
- **Data Exfiltration**: Extracts system information such as MAC addresses and user credentials.
- **Custom Protocol**: Employs an encrypted protocol for secure C2 communication.
- **System Infection Chain**: Uses multiple binaries including a dropper, the modified SSH library, and other infected binaries to ensure access.
## Targeting
- Sectors: Targeting of Linux-based network appliances suggests targeting of IT infrastructure and possibly organizations reliant on such devices.
- Geography: Not specified in the provided text.
- Victims: No specific organizations were named, but the focus is on owners/operators of **Linux-based network appliances**.
## Tools & Infrastructure
- Malware families used: **ELF/Sshdinjector.A!tr** (including a dropper, `libsshd.so`, and infected system binaries).
- Infrastructure (C2, domains, IPs):
- C2 communication occurs via a remote C2 server using an encrypted custom protocol.
- Modification of the legitimate SSH library (`libsshd.so`) is key to C2 communication.
## Implications
This activity indicates a focused effort by DaggerFly to compromise critical network infrastructure running Linux, likely aiming for long-term persistence and covert exfiltration of sensitive data from core network layers. The use of root-level modification of core utilities suggests a high level of operational compromise once successful.
## Mitigations
- Apply updates to Linux systems promptly.
- Monitor network traffic for unusual behavior indicative of C2 communication.
- Employ advanced endpoint protection solutions tailored for Linux environments.
- Regularly audit critical system binaries (`ls`, `netstat`, `crond`) for unauthorized modifications.