A recently resurfaced 20-year-old Trojan, Bifrost, has spawned new Linux variants employing typosquatting to target Linux systems while masquerading as trusted domains, as discovered by Palo Alto Networks researchers. Bifrost, a remote access Trojan (RAT) active since 2004, collects sensitive data like hostnames and IP addresses. Palo Alto Networks has detected over 100 instances of Bifrost Linux samples, raising significant concerns among security experts.
The new variants utilize typosquatting to mimic legitimate VMware domains, allowing the malware to operate undetected. Additionally, there's evidence of cyber attackers expanding Bifrost's reach by offering an ARM version, enabling them to compromise devices incompatible with x86-based malware.
Distribution methods for Bifrost typically involve email attachments or malicious websites, although specifics for the Linux variants' initial attack vectors remain undisclosed. Once installed, Bifrost communicates with a deceptive command-and-control (C2) domain, download. vmfare[.]com, for data transmission using RC4 encryption. The malware also interacts with a Taiwan-based public DNS resolver to resolve domains, enhancing its ability to establish connections.
Despite its age, Bifrost remains a significant threat due to its evolving variants. The adoption of typosquatting complicates detection efforts. Countermeasures suggested by researchers include deploying next-generation firewall products, cloud-specific security services, and employing URL filtering and malware-prevention applications.
In conclusion, Bifrost's sophisticated infection process enables it to bypass security measures and evade detection, posing a severe threat to targeted systems and emphasising the importance of proactive malware tracking and mitigation strategies.
