Thread by @ESETresearch

#ESETresearch analyzed #FontOnLake, a previously unknown #malware family that utilizes custom and well-designed modules, targeting #Linux systems.
welivesecurity.com/2021/10/07/fon…
@HrckaVladislav 1/6

Modules are under development and provide #remoteaccess to the operators, collect credentials + serve as a proxy server. To do this, #FontOnLake uses modified legitimate binaries adjusted to load further components, its presence is always accompanied by a #rootkit. 2/6

The sneaky nature of #FontOnLake tools, along with advanced design and low prevalence suggest usage in targeted attacks. #ESETresearch believes its operators are extra cautious as almost all samples seen use unique C&C servers with varying non-standard ports. 3/6

The first known #FontOnLake file appeared on #VirusTotal last May, other samples were uploaded throughout the year. The location of the C&C server and the countries from which the samples were uploaded to VirusTotal might indicate that its targets include #SoutheastAsia. 4/6

#FontOnLake authors use mostly C/C++ and various third-party libraries such as #Boost, #Poco, or #Protobuf. None of the C&C servers used in samples uploaded to #VirusTotal were active at the time of writing – that indicates they could have been disabled due to the upload. 5/6

All known components of #FontOnLake are detected by #ESET products as Linux/FontOnLake. While finalizing our paper @tsrc_team, @Avast and @laceworklabs published their research on what appears to be the same malware. 6/6