Threat Intel
Quasar Linux RAT: Rootkit, PAM Backdoor, Credential Harvesting in Supply-Chain Threat
TrendAI uncovered Quasar Linux (QLNX), a stealthy Linux RAT that embeds a kernel rootkit, a PAM backdoor, and credential‑harvesting modules. The malware evades most AV, enabling persistent root access in compromised supply chains. Defenders should audit PAM, scan for rootkits, and enforce strict supply‑chain controls.
What happened
TrendAI research identified Quasar Linux (QLNX), a previously undocumented Linux RAT that includes a kernel rootkit, a PAM backdoor, and credential‑harvesting capabilities. The threat was discovered in supply‑chain environments and demonstrates low detection rates against mainstream AV.
Impact
QLNX grants persistent root access, hijacks PAM authentication, and exfiltrates credentials while remaining hidden by its rootkit. Affected systems risk lateral movement, data theft, and prolonged undetected presence.
Detection & Indicators
Watch for unfamiliar PAM modules, unexpected PAM authentication calls, suspicious kernel modules, and binaries named qlnx or similar. Monitor privilege‑escalation events and outbound traffic to unknown IPs.
Mitigation & Response
- Audit and remove unknown PAM modules.
- Run rootkit scanners (chkrootkit, rkhunter) and verify kernel integrity.
- Apply latest security patches to all packages.
- Deploy host‑based IDS to flag PAM backdoor activity.
- Contain compromised hosts, isolate them, and conduct forensic analysis.
Prevention
Enforce strict supply‑chain controls, verify software provenance, and use signed binaries. Apply least‑privilege principles and monitor for anomalous privilege escalations.
Related articles
CrowdStrike Enhances Falcon with Real‑Time Supply‑Chain Defense
CrowdStrike has rolled out a new supply‑chain protection layer inside its Falcon endpoint sensor, blocking malicious open‑source packages as they download. The update expands Falcon’s threat‑intelligence reach, allowing defenders to stop supply‑chain attacks before code ever executes on the host. RootPwn breaks down how the feature works, its impact on the attack surface, and what it means for organizations still hunting for zero‑day supply‑chain exploits.
Read briefing
GTIG Report: Adversarial AI Shifts to Agentic Workflows and Automated Credential Harvesting
Google Threat Intelligence Group reports that threat actors are moving from basic prompting to fully agentic AI workflows, significantly compressing defender response windows. Recent incidents include automated mass credential harvesting executed in under six hours, alongside rising attacks targeting proprietary AI intellectual property and software supply chains.
Read briefing
North Korean Hackers Hijack Fake Coding Interviews with SVG Steganography to Steal Developer Credentials
A new DPRK‑aligned campaign, dubbed REF9403, injects malware into SVG flag images hidden inside seemingly legitimate coding challenge repositories. Triggered when developers run the “coding test,” the payload drops a four‑stage chain—browser credential and crypto‑wallet theft, file exfiltration, a Socket.IO RAT, and clipboard hijacking—mirroring the OTTERCOOKIE family. The attack surfaced after a Slack community received a bogus job posting and was found to be undetected by all major AV vendors. The case underscores the ongoing threat to developers and the need to scrutinize even seemingly har
Read briefing
AI, Supply-Chain, Quantum, and Geopolitical Threats: SecOps Action Plan
Recent analysis highlights four escalating cyber threats—AI‑driven attacks, supply‑chain exposure, quantum computing risks, and geopolitical conflict—that are reshaping the threat landscape. Organizations must treat resilience as an operational priority, updating detection, mitigation, and risk‑management practices accordingly.
Read briefing