Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
Malware

GhostPenguin

GhostPenguin is a previously undocumented Linux backdoor, described by Trend Micro as a multi-threaded C++ malware family that was in an early stage of development when analyzed. It provides remote shell access via /bin/sh and extensive file-system operations, including creating, deleting, renaming, searching, and otherwise manipulating files and directories. The malware collects host information during registration, including IP address, gateway, OS version, hostname, and username, and can execute commands received from its command-and-control (C2) server.

GhostPenguin communicates with its C2 infrastructure over UDP, specifically using UDP port 53, and encrypts traffic with a custom RC5-based, session-oriented protocol. Its communications include a structured handshake, dynamically assigned session IDs, heartbeat-based C2, multi-stage communication, and a custom reliability layer built on top of UDP to ensure delivery of commands and data. The malware architecture uses multiple threads for registration, heartbeat signaling, receiving data, and sending data. Reporting indicates it supports roughly 40 commands.

The sample discussed in the source material evaded detection by all VirusTotal engines for months and was characterized as low-noise and difficult to detect. It minimizes duplicate execution by creating a ".temp" file in the user home directory. The analyzed binary was named "systemd" and had SHA-256 7b75ce1d60d3c38d7eb63627e4d3a8c7e6a0f8f65c70d0b0cc4756aab98e9ab7. Reported C2 infrastructure included 65.20.72.101:53, www.iytest.com:5679, and 124.221.109.147:5679. Trend Micro detects it as Backdoor.Linux.GHOSTPENGUIN.A.

The available content does not attribute GhostPenguin to a specific threat actor or campaign, and no specific victim industry targeting is stated beyond it being a Linux malware threat.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Command and Control

3 techniques
T1071Application Layer ProtocolEvidence1

AI Uncovers GhostPenguin: Undetectable Linux Backdoor Used RC5-Encrypted UDP for Covert C2

T1095Non-Application Layer ProtocolEvidence1

AI Uncovers GhostPenguin: Undetectable Linux Backdoor Used RC5-Encrypted UDP for Covert C2

T1573Encrypted ChannelEvidence1

AI Uncovers GhostPenguin: Undetectable Linux Backdoor Used RC5-Encrypted UDP for Covert C2

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.