Malicious Go Module Drops Rekoobe
Read More: buff.ly/QeSSpFz

#GoModuleMalware #Rekoobe #LinuxSecurity #BackdoorThreat #OpenSourceRisk #CredentialTheft #SupplyChainSecurity #ThreatResearch

Malicious Go Module Deploys Rekoobe Backdoor

~Socket~
A malicious Go module impersonates a legitimate crypto library to steal passwords and deploy the Rekoobe backdoor.
-
IOCs: 154. 84. 63. 184, img. spoolsv. cc, img. spoolsv. net
-
#GoLang #Rekoobe #SupplyChain #ThreatIntel

REKOOBE APT-31 Linux Backdoor Analysis In this post I will be taking a look at a Linux backdoor known as REKOOBE1 https://malpedia.caad.fkie.fraunhofer.de/details/elf.rekoobe ↩

I took a look at the #rekoobe #linux backdoor and wrote a blog post about how to recover the C2 details from the sample. I also wrote a config extractor to automate the process: blog.techevo.uk/analysis/lin...
#malware #radare2