S0641 Kobalos

malwareEnterprise

platformsLinux

also known asKobalos

Kobalos is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. Kobalos has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. Kobalos was first identified in late 2019.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1048Exfiltration Over Alternative Protocol
T1056Input Capture
T1059.004Unix Shell
T1070.003Clear Command History
T1070.006Timestomp
T1074Data Staged
T1082System Information Discovery
T1090.003Multi-hop Proxy
T1140Deobfuscate/Decode Files or Information
T1205Traffic Signaling
T1554Compromise Host Software Binary
T1573.001Symmetric Cryptography
T1573.002Asymmetric Cryptography

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan