Bifrost Trojan dodges detection with sneaky Linux variants through typosquatting

TLDR:

• A new Linux variant of the Bifrost Trojan has been detected by Palo Alto Networks
• The malware uses typosquatting to impersonate a legitimate VMware domain and evade detection

Researchers from Palo Alto Networks have identified a resurgence of the 20-year-old Bifrost Trojan with new Linux variants that have been targeting Linux systems. This Trojan utilizes typosquatting to mimic a trusted VMware domain, allowing it to avoid detection by security measures. Bifrost is a remote access Trojan that has been active since 2004, collecting sensitive information from compromised systems such as hostname and IP address.

There has been a significant increase in the number of Bifrost Linux variants in recent months, with over 100 instances detected by Palo Alto Networks. These variants pose a threat to organizations and individuals alike, with cybercriminals looking to expand the malware’s reach by including ARM-based malware versions. This shift towards ARM-based devices as targets enhances the attackers’ capabilities and allows them to compromise a wider range of devices.

Attackers typically distribute Bifrost through email attachments or malicious websites, with the malware reaching out to a command-and-control (C2) domain with a deceptive name resembling a legitimate VMware domain. Once installed on a victim’s system, Bifrost collects user data and sends it back to the C2 server using encryption to evade detection. The researchers shared indicators of compromise to help organizations protect their systems against Bifrost and emphasize the importance of tracking and countering such malware to safeguard sensitive data.

Enterprises are advised to employ next-generation firewall products and cloud-specific security services to enhance their defenses against Bifrost and similar threats. Despite its age, the Bifrost RAT remains a potent threat that can bypass security measures and compromise targeted systems. Staying vigilant and implementing robust security measures are essential in combating evolving malware like Bifrost.