New Bifrost malware for Linux mimics VMware domain for evasion

Summary:

A new variant of Bifrost, a remote access Trojan (RAT), has emerged, utilizing a deceptive domain reminiscent of legitimate VMware domains. This deceptive tactic aims to circumvent security measures and compromise targeted systems. Bifrost poses a significant threat by allowing attackers to gather sensitive information, such as hostname and IP address. The recent surge in Bifrost's Linux variants raises concerns among security experts and organizations.[emaillocker id="1283"]

Bifrost facilitates unauthorized access to victim systems, allowing threat actors to collect sensitive information such as hostnames and IP addresses. The latest variant of Bifrost employs a stripped binary compiled for x86, hindering analysis efforts. Upon execution, the malware establishes communication with a command and control (C2) server through socket creation and collects victim data, encrypting it using RC4 encryption. Furthermore, the malware attempts to contact a public DNS resolver to resolve the deceptive domain, enhancing its evasion capabilities.

The evolving nature of Bifrost RAT, coupled with the adoption of deceptive domain strategies, underscores the persistent threat posed by this malware. Observations of a surge in Bifrost activity highlight the importance of proactive detection and efforts to sensitive data and protect against unauthorized access. Counteracting threats like Bifrost remains crucial in maintaining the security and integrity of computer systems, mitigating potential risks to individuals and organizations.

Threat Profile:

References:

The following reports contain further technical details:

https://www.bleepingcomputer.com/news/security/new-bifrost-malware-for-linux-mimics-vmware-domain-for-evasion/