Pierluigi Paganini January 13, 2022

Security researchers found a new cross-platform backdoor, dubbed SysJoker, the is suspected to be the work of an APT group.

Security experts from Intezer discovered a new backdoor, dubbed SysJoker, that is able to infect Windows, macOS, and Linux systems.

The experts spotted a Linux variant of the backdoor in December while investigating an attack against an educational institution. Later the experts identified Mac and Windows PE versions of the malware, they pointed out that the Linux and Mac versions are fully undetected in VirusTotal.

The analysis of the C2 domain registration and samples found in VirusTotal suggests that the SysJoker has been active at least since the second half of 2021.  

SysJoker masquerades as a system update, experts believe that it was developed to infect specific targets.

“SysJoker masquerades as a system update and generates its C2 by decoding a string retrieved from a text file hosted on Google Drive. During our analysis the C2 changed three times, indicating the attacker is active and monitoring for infected machines. Based on victimology and malware’s behavior, we assess that SysJoker is after specific targets.” reads the report published by Intezer.

The backdoor was uploaded to VirusTotal with the suffix .ts which is used for TypeScript files, experts believe that a possible attack vector is via an infected npm package.  

The C2 is generated by decoding a string fetched from a text file on Google Drive.

The behavior of SysJoker is similar for all the three operating systems, it gathers information about the machine using Living off the Land (LOtL) commands.

Based on instructions received from the C2 server, SysJoker implements multiple capabilities, such as executing commands, dropping and running additional payloads.

The analysis of the instruction names revealed that the malware also supports commands apparently related to a self-deletion mechanism that has yet to be implemented.

Experts believe that SysJoker was developed by an advanced threat actor for the following reasons:

1. The code was written from scratch, this is a rarity for Linux malware.
2. The attacker registered at least 4 different domains and wrote from scratch the malware for three different operating systems.
3. Researchers haven’t disocvered a second stage or command sent from the attacker. This suggests that the attack is specific which usually fits for an advanced actor.  

“Based on the malware’s capabilities we assess that the goal of the attack is espionage together with lateral movement which might also lead to a Ransomware attack as one of the next stages,” Intezer concludes.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, SysJoker)

[adrotate banner=”5″]

[adrotate banner=”13″