Read Time:1 Minute, 37 Second
FortiGuard Labs is aware of the discovery of a new Linux malware variant that is not only complex in design, but modular. Dubbed ‘Lightning Framework’, the malware consists of various modules for different functionality. At this time, there is no report of Lightning Framework being used or observed in the wild attacks.Why is this Significant?This is significant because Lightning Framework is a previously unknown modular malware for Linux that can download and install different modules (including rootkits) and plugins to a targeted machine. While there are no reports of the malware being used in the wild, it can be safely surmised that the Lightning Framework can be expected and incorporated in real attacks soon.What is Lightning Framework?Lightning Framework is a modular malware that consists of various modules for different functionality.A Lightning Framework infection starts with an installation of the Lightning.Downloader module on the compromised Linux machine. This module connects to its Command-and-Control (C2) server and is used to download other additional and plugins including Lightning.Core. Lightning.Core is the main module of Lightning Framework and is responsible for receiving commands from the C2 server and to execute remote commands. Other modules that are downloaded by Lightning.Downloader are:Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Sshd, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf.According to the Intezer blog the modules: Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf are referenced only in the source and actual files have not been discovered in the wild.Furthermore, to add insult to injury – Lightning Framework can open a SSH backdoor using the Linux.Plugin.Lightning.Sshd plugin upon receiving a remote command.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against available modules and plugins of Lightning Framework:Linux/Agent.PA!trLinux/Agent.B5B5!trLinux/Agent.C492!tr
