Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement

While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.

actor backdoor cobalt cobalt strike earth earth lusca encrypted file implementation lateral movement linux malware monitoring reports server socks strike swift threat threat actor trend micro research : articles trend micro research : malware trend micro research : research trochilus windows