It is an AI-generated #Linux #malware which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, #rootkit #hideproc, tries to hide the Koske miner from file listings and processes.
https://malwarelab.eu/posts/koske-panda-ai/
Video from #anyrun analysis:
AI-Generated Malware in Panda Image Hides Persistent Linux Threat
A sophisticated Linux malware campaign called Koske has been discovered, showing signs of AI-assisted development. The threat exploits misconfigured servers to install backdoors and download weaponized JPEG images containing malicious payloads. The malware uses polyglot file abuse to hide shellcode within images, deploys a userland rootkit, and employs various persistence techniques. It aggressively manipulates network settings to ensure command-and-control communication. The malware supports 18 different cryptocurrencies and adapts its mining strategy based on the host's capabilities. The code structure and adaptability suggest AI involvement in its creation, marking a concerning shift in malware development and posing significant challenges for cybersecurity defenses.
Pulse ID: 68828d2d536ef213a5f043b8
Pulse Link: https://otx.alienvault.com/pulse/68828d2d536ef213a5f043b8
Pulse Author: AlienVault
Created: 2025-07-24 19:44:45
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
"#Malware maker sponsors a #shitpost by a #TechIlliterate #Windows n0ob to sell their #Rootkit to #TechIlliterates" would'nt be as clickbaity but a #HonestVideoTitle instead...
Sicherheitsforscher haben ein #Linux-#Rootkit entwickelt, das die #Kernel-#API io_uring ausnutzt, um unentdeckt zu bleiben. Überwachungstools erkennen etwaige Angriffe darüber nicht. https://winfuture.de/news,150557.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia
#Hackers can now bypass #Linux #security thanks to terrifying new Curing #rootkit
https://betanews.com/2025/04/24/hackers-bypass-linux-security-with-armo-curing-rootkit/
"Passwort" Folge 25: Staatlich sanktionierte Schnüffelsoftware
Dieses Mal nehmen sich die Podcast-Hosts eines kontroversen Themas an: Unternehmen installieren über Sicherheitslücken Malware - und das in staatlichem Auftrag.
@stonehead Hi! I'm glad you asked because I'm sure there are many more people wondering about the same thing! :)
Yes, there is always a risk when you download something from open sources. However, you really cannot trust official sources as well. A good example is Sony's rootkit scandal. [1][2]
Doing basic internet "hygiene" will prevent you from most viruses, though. Having a decent virus scanner will do wonders [3], and the rest comes down to common sense. Be very careful with executables, keep your software (like PDF readers) up to date, look for settings to turn off scripts and perhaps consider sanitizing your PDFs before opening them. [4][5]
An interesting point on the aforementioned website is the following:
"With budgets getting tighter, we understand the appeal of free antivirus software. While there have been great changes in free subscriptions, the most notable being they now offer real-time malware protection, they are still minimal compared to a full antivirus security suite.
There are some exceptions, but most free antivirus programs don't offer web protections. This means they won't stop malware from downloading if you accidentally click on a malicious link. They will snatch it before it has a chance to infract your computer, but we feel better than a threatening file doesn't get that far into the process."
I hope this helped you on your way, and if not, do let me know! :)
----------
[1] https://www.theregister.com/2005/11/01/sony_rootkit_drm
[2] https://www.theregister.com/2021/12/10/autorunning_away/
[3] https://www.techradar.com/best/best-free-antivirus (go to the product's websites manually to avoid tracking through links)
[4] https://github.com/Kerbalnut/Sanitize-PDF
[5] https://www.webpdf.de/en/pdf-redact-and-sanitize
----------
Reptile is a Linux kernel mode rootkit malware that provides a concealment feature for files, directories, processes, and network communications.
