Stealthy Linux backdoors pose as email tools in Asia

Researchers have identified new Linux backdoors targeting telecom and network-edge devices in South Korea and Taiwan. The malware, detailed by Rapid7, mimics legitimate email and security services to evade detection, sending command-and-control traffic disguised as standard mail activity. Some variants adopt process names from well-known anti-spam products, hindering identification. At least one implant communicates through port 25 and uses typical email protocols to blend in with business network traffic.

• Backdoors target devices in South Korea and Taiwan
• Malware camouflages itself as common network processes
• Some variants mimic well-known anti-spam program names
• Command traffic uses port 25 to appear as normal email
• Attribution is ongoing; full scope is yet unclear