An extremely evasive Linux malware has been discovered and dubbed “Symbiote,” thanks to a joint effort between BlackBerry’s Threat Research & Intelligence Team and Intezer. The companies released their findings in a report co-authored by Joakim Kennedy and Ismael Valenzuela.

Symbiote is unique from any other malware that Linux has previously seen. It is a significant threat due to differences from other malware which is commonly run as a standalone executable file to infect a machine, according to the findings.

Rather, Symbiote is loaded onto all running processes and can provide a threat actor with a rootkit, allowing an unauthorized user to gain control of a system without detection, as well as credential harvesting, and remote access capabilities. 

Symbiote’s technique of infecting all running processes rather than a single process simplifies hijacking imports from other files on an infected machine.

If Symbiote successfully infects a machine it is nearly impossible to detect, according to the report, because of its complexities. Once run, it is hidden along with other malware infiltrated by a threat actor. 

Symbiote’s use of the Berkeley Packet Filter, or BPF, allows the malware to not only disguise itself on an infected file system, but also hides its network traffic with the filter’s hooking functionality. Use of BPF has been documented in the past, notably in Equation Group’s “hacking tools,” but Symbiote has a different, threatening intent. 

By using BPF, Symbiote can easily filter out any network traffic that would reveal its activity if someone were to investigate suspicious traffic. It can essentially decide what results to display to callers, as well as hide other malware files likely deployed with it. 

This disguise gives a threat actor backdoor access to a victim’s machine, allowing them to login as any user to “execute commands with the highest privileges.”

Although Symbiote is highly evasive malware, precautions can still be taken when analyzing a machine’s health. Machine administrators can use network telemetry to assist in detecting possible malware. 

Symbiote’s last reported development was in November of 2021, when it was likely written to target the financial sector of Latin America and impersonate Brazilian banks and customers. As attackers are progressively targeting cloud workloads and servers, it is probable that similar Symbiote threats will increase, noted the report.

Currently, the BlackBerry Threat Research and Intelligence team is continuing to contribute to countermeasures necessary in preventing Symbiote’s impact, which remains to be seen.