Loading story…
Trend Micro disclosed a previously undocumented Linux implant, Quasar Linux RAT (QLNX), that targets developer workstations and DevOps environments to steal credentials tied to software supply chains. The malware harvests secrets from assets including npm, PyPI, Git, AWS, Kubernetes, Docker, Vault, Terraform, GitHub CLI, .env files, SSH keys, browser data, and even /etc/shadow, creating a path to malicious package publication, cloud account compromise, and CI/CD abuse. Researchers said the implant combines backdoor, surveillance, credential theft, and lateral movement features, with a 58-command RAT core supporting shell execution, file management, screenshots, keylogging, clipboard theft, SOCKS proxying, TCP tunneling, and SSH-based movement across environments.
The malware was built for stealth and long-term persistence on Linux systems. Trend Micro said QLNX runs filelessly from memory, deletes its original binary, wipes logs, spoofs process names as kernel threads, and uses multiple persistence methods including LD_PRELOAD, systemd, crontab, init.d, XDG autostart, and .bashrc injection. It also dynamically compiles rootkit and PAM credential-interception components on the victim host using gcc, then hides processes, files, and ports through a two-tier design that combines a userland LD_PRELOAD rootkit with an eBPF kernel component. Command-and-control traffic can flow over raw TCP, custom TLS, HTTP, or HTTPS, and at publication only a small number of security products reportedly detected the malware, while no actor attribution or confirmed intrusions had been publicly disclosed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage expanded on QLNX's capabilities, including theft of secrets from npm, PyPI, Git, AWS, Kubernetes, Docker, Vault, Terraform, GitHub CLI, and .env files. It also highlighted PAM credential interception and a two-tier rootkit architecture using LD_PRELOAD and an eBPF kernel component for stealth.
Red Asgard reported that server 195.201.104.53 hosted both BeaverTail FTP exfiltration infrastructure and OtterCookie command-and-control services, indicating shared Lazarus-linked operational infrastructure. The finding shifted the model from one host per campaign to a shared substrate supporting multiple malware families and operational lanes.
Trend Micro published analysis of a previously undocumented Linux implant called Quasar Linux (QLNX) aimed at developer and DevOps environments. The malware was described as a stealthy, fileless RAT with credential theft, persistence, rootkit, surveillance, and supply-chain risk implications, though no actor attribution or confirmed attacks were provided.
A report published by OSM described Lazarus Group tradecraft involving the use of Git hooks to conceal malware. The referenced coverage tied the activity to DPRK-linked operations, but the provided material did not include further technical details or victim information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourceredasgard.com
Open sourcebsky.app
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
Researchers have identified **STX RAT**, a newly observed remote access trojan that pairs credential theft with **hidden virtual network computing (HVNC)** to let attackers control infected Windows systems without visible on-screen activity. The malware was seen in early 2026 delivered through a browser-downloaded VBScript chain that launched JScript, fetched a TAR archive, and used a PowerShell loader for in-memory injection; a separate campaign used trojanized **FileZilla** installers. Analysis found anti-analysis checks for **VirtualBox**, **VMware**, and **QEMU**, along with a random-delay “jitter exit” and an **AMSI ghosting** technique that patches a Windows RPC function to reduce detection. STX RAT communicates with command-and-control infrastructure at `95.216.51.236` using **X25519 ECDH** and **ChaCha20-Poly1305** encryption, then exfiltrates host information, screenshots, and credentials from tools including **FileZilla**, **WinSCP**, and **Cyberduck**. Its HVNC capability is considered the most dangerous feature because it creates invisible desktop sessions that allow attackers to interact with the victim machine covertly. Defenders were urged to block the known C2 IP and associated Tor onion infrastructure, monitor suspicious **WScript** and **PowerShell** activity, apply available **YARA** detections, and disable **VBScript** and **JScript** where operationally possible.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026