Analysis of the backdoor, named RotaJakiro by researchers at Qihoo 360's Network Security Research Lab (360 Netlab), revealed that it enables attackers to harvest and exfiltrate sensitive information from compromised devices.
BleepingComputer reports that the malware isn’t picked up by VirusTotal's anti-malware engines, despite the fact that a sample was first uploaded to its database in 2018.
We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.
- Protect your devices with these best antivirus software
- Here are the best firewall apps and services
- We’ve also rounded up the best ransomware protection tools
The 360 Netlab researchers say that the malware uses the ROTATE encryption algorithm and has different profiles that it employs depending on whether its executing on a root or a non-root account.
Once it’s made itself home, it establishes communication with the command and control (C&C) server and awaits instructions.
The researchers note that RotaJakiro takes several steps to ensure it stays under the radar, including compressing and encrypting its communication channels using ZLIB, AES, XOR, ROTATE algorithms.
More worryingly however, the 360 Netlab researchers are clueless as to the true intent of the threat actors behind the malware.
“RotaJakiro supports a total of 12 functions, three of which are related to the execution of specific Plugins. Unfortunately, we have no visibility to the plugins, and therefore do not know its true purpose,” admit the researchers.
They believe their analysis is just the “tip of the iceberg” and the malware will remain a threat until they uncover its true intentions and how it managed to spread.
- These are some of the best endpoint protection software offerings around