Rekoobe
Rekoobe is a Linux trojan/backdoor that has been detected in the wild since at least 2015. The content describes it as a backdoor capable of receiving commands from an attacker-controlled server to download additional payloads, steal files, and execute a reverse shell. It is associated in the reporting with Chinese nation-state activity, particularly APT31 (also referred to as Zirconium), and one source notes partial lineage from the Tiny SHell codebase.
In the provided reporting, Rekoobe was delivered as a later-stage payload in a supply-chain attack involving a malicious Go module, github.com/xinfeisoft/crypto, which impersonated the legitimate golang.org/x/crypto package. That module modified ssh/terminal/terminal.go and hooked ReadPassword() to capture plaintext credentials entered at terminal prompts, write them locally to /usr/share/nano/.lock, exfiltrate them to attacker-controlled infrastructure, and then execute a shell-script stager. The stager established persistence by appending an attacker SSH key to /home/ubuntu/.ssh/authorized_keys, weakened host defenses by setting iptables default policies to ACCEPT, and downloaded additional payloads disguised as .mp5 files. The payload 555.mp5 was confirmed as the Rekoobe Linux backdoor; the staged payloads also included sss.mp5 as a loader/reconnaissance component.
Observed infrastructure and indicators directly mentioned in the content include communication with 154.84.63.184 over TCP port 443, including at least one flow that did not resemble a standard TLS ClientHello; staged payload names sss.mp5 and 555.mp5; SHA-256 for 555.mp5: 8b0ec8d0318347874e117f1aed1b619892a7547308e437a20e02090e5f3d2da6; and SHA-256 for sss.mp5: 4afdb3f5914beb0ebe3b086db5a83cef1d3c3c4312d18eff672dd0f6be2146bc. Separate Fortinet reporting in the content states that malware in one FortiOS intrusion cluster bore similarities to Rekoobe malware commonly used by APT31, in campaigns targeting highly selected victims including government, critical infrastructure, manufacturing, consultancies, and service providers/ISPs.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
Credential Access
1 technique
Credential Access
Collection
2 techniques
Collection
Command and Control
4 techniques
Command and Control
"The backdoor is capable of receiving commands from an attacker-controlled server to download more payloads, steal files, and execute a reverse shell."
“exfiltrates passwords via HTTP POST… fetches a GitHub hosted ‘update’ resource”
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux backdoor/RAT delivered via a malicious Go supply-chain package; used to establish unauthorized access on Linux systems after credential harvesting and staging activity.
A backdoor deployed by a malicious Go module; the trojanized library steals user passwords and then installs the Rekoobe backdoor on compromised systems.
Linux backdoor/trojan that communicates with an attacker-controlled server to receive commands, download additional payloads, steal files, and provide reverse shell capability.
Linux backdoor delivered via a multi-stage supply-chain-driven dropper chain. In this campaign it is fetched from attacker infrastructure, executed on the victim host, and communicates outbound to 154[.]84[.]63[.]184 over TCP/443 using non-standard (non-TLS-handshake) traffic suggestive of custom encryption masquerading as HTTPS.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.