New PamDOORa Backdoor Attacking Linux Systems to Steal SSH Credentials

Overview of the New PamDOORa Backdoor

A new backdoor named PamDOORa is targeting Linux systems to steal SSH credentials. This sophisticated malware leverages the Pluggable Authentication Modules (PAM) framework, a critical component in Unix and Linux-based operating systems for managing user authentication.

Key Features of PamDOORa

1. Infection Vector:

   • The backdoor infects Linux servers by modifying PAM configurations to execute malicious scripts during SSH login attempts.

2. Malicious Script Execution:

   • A script named tn.sh is executed via the pam_exec.so module, which is a legitimate PAM module used for executing external commands.

3. Credential Capture and Exfiltration:

   • Captured credentials are stored in /tmp/ with dynamically generated filenames.
   • The stolen credentials are exfiltrated using netcat (nc) over port 1234.

Indicators of Compromise (IoCs)

• File Name: pam_linux.so

  • Description: Malicious PAM shared object injected into the authentication stack.

• Script Executed via pam_exec:

  • File

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.