Elastic Security Labs published details on REF6138, a campaign where attackers compromised Linux build pipelines to inject persistent backdoors into core utilities. The targets were Red Hat-based distributions, specifically CentOS and Fedora, in telecommunications and government sectors across Asia and Europe.

The technical approach is worth understanding: the attackers didn’t just drop a binary. They modified source code and build scripts (configure, Makefiles) for curl, sudo, and sshd. By adding compilation flags and linking malicious object files during the build, the resulting binaries appeared legitimate—checksums and signatures were adjusted where possible. This means standard package manager refreshes wouldn’t remove the backdoor; only a full rebuild from verified media suffices.

The backdoors themselves are operationally careful. The sudo variant checks environment variables before activating—only matching conditions trigger payload execution. Otherwise, it behaves as the real sudo. The sshd backdoor goes further: it intercepts credentials, exfiltrates them, and can establish SOCKS proxies for lateral movement. Command-and-control uses domain generation algorithms with valid SSL certificates from compromised domains, mimicking HTTPS traffic.

Initial access came via known vulnerabilities in Apache Tomcat and Jenkins servers. From there, attackers moved laterally to build servers and package repositories. This is the critical engineering lesson: securing perimeter services is necessary but not sufficient. Once an attacker gains code execution on a build server, they can poison the entire software supply chain for downstream systems.

Forensic artifacts show consistent use of living-off-the-land techniques—bash scripts and compiled binaries, no PowerShell. Memory-resident components reduce disk footprint. Anti-analysis features include timing checks and debugger detection; under analysis, the malware either terminates or switches to benign behavior.

For engineering teams, the practical takeaways are clear. Implement immutable infrastructure where possible. Use signed packages from trusted mirrors exclusively. Regularly verify system binaries with rpm -V or dpkg --verify against known-good checksums. Network segmentation limits blast radius, but behavioral monitoring is essential—anomalous activity from trusted utilities like sudo or sshd is a red flag.

The campaign shares infrastructure and code patterns with APT41 and UNC961. The targeting aligns with Chinese intelligence priorities. As Linux adoption grows in cloud and containerized environments, this attack pattern will become more common. Build pipeline security is now a first-class concern, not an afterthought.

Source: Webpronews