EXECUTIVE SUMMARY
The 'sedexp' malware, has been actively evading detection since 2022, targeting Linux systems with a stealthy persistence technique that leverages udev rules, a method not yet documented in the MITRE ATT&CK framework. The malware is notable for its ability to create reverse shells, allowing attackers to remotely access compromised systems. The malware has been linked to financially motivated cybercriminals, specifically in attacks involving the concealment of credit card scraping code on compromised web servers. Despite being available in multiple online sandboxes, 'sedexp' has remained largely undetected, with minimal antivirus recognition, underscoring its advanced evasion capabilities and potential threat to Linux-based infrastructures.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
The 'sedexp' malware, has been actively evading detection since 2022, targeting Linux systems with a stealthy persistence technique that leverages udev rules, a method not yet documented in the MITRE ATT&CK framework. The malware is notable for its ability to create reverse shells, allowing attackers to remotely access compromised systems. The malware has been linked to financially motivated cybercriminals, specifically in attacks involving the concealment of credit card scraping code on compromised web servers. Despite being available in multiple online sandboxes, 'sedexp' has remained largely undetected, with minimal antivirus recognition, underscoring its advanced evasion capabilities and potential threat to Linux-based infrastructures.[emaillocker id="1283"]
'Sedexp' employs a unique persistence mechanism using udev rules, which are configuration files that manage device events in the Linux kernel. The malware adds a custom udev rule that triggers whenever the /dev/random device is loaded, ensuring that its malicious script, 'asedexpb,' is executed frequently, including at system reboot. This rule is particularly insidious as /dev/random is a critical system component that is rarely monitored by security tools. In addition to its persistence strategy, 'sedexp' disguises itself by naming its process 'kdevtmpfs,' mimicking legitimate system processes. It also uses memory manipulation techniques to hide files containing the string "sedexp" from standard system commands like 'ls' or 'find,' further enhancing its stealth. The malware's capabilities extend to setting up reverse shells through techniques like forkpty or piping, allowing attackers to maintain a foothold in the compromised system while remaining undetected.
The discovery of 'sedexp' highlights the increasing sophistication of financially motivated threat actors who are leveraging novel and obscure techniques to maintain persistence and evade detection. The use of udev rules, a method not yet widely recognized or monitored, allows the malware to operate in plain sight, bypassing conventional security measures. This case emphasizes the importance of continuous monitoring and the need for advanced forensic tools to detect such threats. Organizations must ensure their security practices are up-to-date and capable of identifying and mitigating emerging threats like 'sedexp.' Engaging specialized Digital Forensics and Incident Response (DFIR) teams for in-depth analysis of compromised systems is crucial in defending against such advanced threats.
THREAT PROFILE:
| Tactics | Technique ID | Technique |
| Execution | T1059 | Command and Scripting Interpreter |
| Persistence | T1546 | Event Triggered Execution |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information |
| T1070 | Indicator Removal | |
| Command and Control | T1105 | Ingress Tool Transfer |
REFERENCES:
The following reports contain further technical details:
[/emaillocker]