Threat actors commonly name their malicious software after a legitimate operating system component or process as a defense evasion measure. By borrowing the name of a real binary, the malware may avoid raising suspicion during routine system inspection, allowing it to persist quietly on compromised appliances.

The campaign focuses on telecom and network infrastructure, sectors that are frequently targeted for their strategic value and their role in carrying large volumes of sensitive traffic.

Key points:

• Targets include telecom and network appliances in South Korea and Taiwan.
• Traffic is disguised as email services to avoid network-based detection.
• Malicious processes impersonate legitimate system binaries on Linux hosts.
• The technique is a classic defense evasion tactic aimed at blending into normal system activity.

If your organization runs Linux-based telecom or network appliances in these regions, review running processes and outbound email-related traffic for anything that does not match a known, legitimate binary or service.

Source: The Hacker News
Does your organization operate Linux-based telecom or network appliances in these regions, and how are you hunting for impersonated processes on those systems?