Symbiote Linux Malware Flies Under the Radar

Security experts with BlackBerry Threat Research published a joint research post on a new strain of Linux malware, dubbed Symbiote.

The malware was first discovered in early 2022. Its main highlight is just how hard it is to detect - the team calls Symbiote "almost impossible" to detect on a system.

Symbiote functions like a shared object library on the target system, in contrast to most Linux malware that will seek to compromise already running processes. Instead, Symbiote is loaded on all running processes on the victim system using VIA_PRELOAD.

Once fully deployed, Symbiote offers rootkit capabilities to its operators. The malware makes use of Berkeley Packet Filter hooking, which allows it to mask malicious packet traffic on an infected system. The researchers explained that if a system admin attempts to use a packet capture and monitoring tool to look for malicious activity, Symbiote would inject Berkeley Packet Filter bytecode that tells the kernel which packets to capture, allowing the malware to shape what traffic shows up in the capture.

Symbiote keeps a very low profile, getting pre-loaded before all other shared objects on the system, which allows it to stay hidden. It can also harvest credentials from the compromised systems.

The Symbiote malware's earliest discovered sample dates back to late 2021 and was likely used to target banking institutions in South America.