A new Linux-focused cyberattack campaign linked to APT41, also known as Winnti, is targeting cloud environments with a stealthy backdoor designed to steal sensitive credentials.
Security researchers discovered a previously undetected ELF malware sample actively operating across major cloud platforms, including AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud.
The malware stands out because it had zero detections on security platforms at the time of discovery.
It is a stripped, statically linked 64-bit executable, making analysis more difficult and helping it evade traditional defenses. Once deployed on a cloud server, the malware silently collects credentials and metadata that can give attackers deep access to cloud resources.
Advanced Credential Theft and Covert Communication
The backdoor is specifically designed to harvest credentials from multiple cloud providers.
It queries internal metadata services used by AWS, Azure, Google Cloud, and Alibaba Cloud to retrieve access tokens and identity information. It also scans local files such as configuration folders that store credentials.
All collected data is encrypted using AES-256 and prepared for exfiltration. Instead of using common web-based communication methods like HTTP or HTTPS, the malware uses SMTP over port 25.
This is unusual because SMTP is typically used for email traffic, allowing the malware to blend in with normal network activity.
Attacker commands are hidden within SMTP responses, while stolen data is sent via specially crafted email-like messages. This technique helps bypass many security tools that do not deeply inspect SMTP traffic.
Another key feature is a selective handshake mechanism used by the command-and-control server. The server only responds to infected machines that present a valid authentication token.
If a scanner or security tool attempts to connect, it sees only a normal SMTP service and is quickly disconnected. This makes the malicious infrastructure effectively invisible to internet scanning tools.
Infrastructure and Evasion Techniques
The attackers use typosquatting domains that mimic legitimate Alibaba Cloud services to host their command servers.
These domains were registered within a short 24-hour window, showing a coordinated infrastructure setup. The command server itself is hosted on Alibaba Cloud in Singapore.
The malware also supports lateral movement by sending UDP broadcast messages within the local network. This allows infected machines to discover and communicate with each other without relying heavily on external servers.
According to Breakglass research, this campaign is part of a six-year evolution of Winnti’s Linux malware, moving from simple backdoors to advanced, cloud-aware threats. The latest version shows a clear focus on stealing cloud credentials and avoiding detection.
Security teams are advised to monitor unusual SMTP traffic, block suspicious domains, and audit access to cloud metadata services.
As attackers continue to refine their techniques, defending cloud environments requires deeper visibility and stricter access controls.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
