Fortinet’s FortiGuard Labs has published new research focusing on ELF/Sshdinjector.A!tr, a malware strain that targets Linux systems, including IoT devices and network appliances. The malware is capable of data exfiltration and has been attributed to the DaggerFly espionage group, which utilized this malware in the Lunar Peek campaign against network appliances.

The research details various components of the malware collection, which emerged around mid-November 2024. Critical to the attack is a dropper that determines if the host is infected. If it is not, the dropper deploys malicious binaries in specific locations. A key element in this scheme is a rogue secure shell (SSH) library named libsshd.so, which communicates with a remote bot master to exfiltrate data. Additionally, other infected binaries like mainpasteheader and selfrecoverheader work to maintain the infection.

FortiGuard Labs emphasized the necessity of human analysis in conjunction with artificial intelligence (AI) tools for reverse engineering. While disassemblers and decompilers have seen substantial improvements, AI plays a crucial role in summarizing malware samples and generating comprehensible source code. To harness AI effectively, human oversight is essential to prevent errors and ensure pertinent aspects of the analysis are adequately addressed.

This research underscores the evolving landscape of cyber threats and the increasing sophistication of malware targeting Linux platforms.