Loading malware…
Rekoobe is a Linux backdoor derived in part from the open-source Tiny SHell codebase and observed in the wild since at least 2015. It is associated in multiple public reports with China-linked espionage activity, particularly APT31, and has also appeared alongside Linux rootkits such as Syslogk and in supply-chain compromises targeting developers and server environments.
Rekoobe is a compiled ELF malware family for Linux, with reported support for x86, x64, and SPARC architectures, indicating a focus on Unix-like server systems. Core functionality includes encrypted command-and-control communications, remote command execution through a reverse shell, file upload and download, and retrieval of additional payloads. Variants have been documented in both reverse-shell and bind-shell forms. Some samples masquerade as legitimate processes, including changing the process name to resemble common shell processes, to reduce operator visibility.
The malware has been described as using HMAC-SHA1-derived AES-128 to protect command-and-control traffic and performing an integrity-verification exchange before accepting commands. In operational use, Rekoobe has been deployed as a stealthy user-mode payload paired with kernel-level concealment. In one documented pairing, the Syslogk rootkit hid the Rekoobe payload, concealed related files, processes, and network activity, and used specially crafted magic packets to start or stop the backdoor on demand. Rekoobe has also been embedded in fake service behavior, including impersonating an SMTP server until triggered to spawn a shell.
Observed delivery and installation paths include supply-chain compromise through a malicious Go module impersonating a legitimate cryptographic library, as well as reported deployment through compromised web application components such as a WordPress plugin. In those campaigns, Rekoobe functioned as a later-stage Linux payload after credential theft, staging, persistence establishment, and host weakening. Targeting has centered on Linux servers, including poorly maintained or unpatched systems, and reporting has noted victimology in Korean organizations as well as broader espionage-oriented operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
This malware bears similarities to Rekoobe Malware, which is commonly used by APT31.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Rekoobe is a backdoor known to be used by APT31, a threat group based in China.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Additionally, there have been reported cases of supply chain attacks where a threat actor targeted a popular WordPress plugin and installed Rekoobe to gain control over compromised systems.
The reverse shell command also has a simple format of redirecting the standard input and output to the socket connected to the C&C server and executing /bin/sh.
"adding a threat actor's SSH key to the 'authorized_keys' file"
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine... These are known as magic packets because they have a special format and special powers.
Adore-Ng is a relatively old, open-source, well-known kernel rootkit for Linux... It enables hiding processes, files, and even the kernel module... In this post, we refer to this rootkit as Syslogk rootkit.
Rekoobe disguises itself by changing its process name to “/bin/bash”, which matches the name of a normal process.
“downloads additional payloads… while disguising them with the .mp5 extension”
"executes them, and deletes them from disk to reduce forensic evidence."
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine... These are known as magic packets because they have a special format and special powers.
First, it checks whether the packet is a TCP packet and, in that case, it also checks the source port, which is expected to be 59318. Rekobee will be executed by the rootkit if the magic packet fits the mentioned criteria.
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine, which inspects the traffic by installing a netfilter hook.
The malicious payload is hidden from tools like Netstat; when running, it will not appear in the list of services. For this purpose, the rootkit uses the function hk_t4_seq_show.
“exfiltrates passwords via HTTP POST… fetches a GitHub hosted ‘update’ resource”
Depending on the value of this 1 byte, three different commands can be performed: file upload, file download, or reverse shell execution.
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine... These are known as magic packets because they have a special format and special powers.
First, it checks whether the packet is a TCP packet and, in that case, it also checks the source port, which is expected to be 59318. Rekobee will be executed by the rootkit if the magic packet fits the mentioned criteria.
The attacker remotely executes it on demand when a specially crafted TCP packet... is sent to the infected machine, which inspects the traffic by installing a netfilter hook.
It is a compiled backdoor trojan written in C programming language... widely known as the Rekoobe malware family... embedded in a fake SMTP server, which spawns a shell when it receives a specially crafted command.
104 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux backdoor/RAT delivered via a malicious Go supply-chain package; used to establish unauthorized access on Linux systems after credential harvesting and staging activity.
A backdoor deployed by a malicious Go module; the trojanized library steals user passwords and then installs the Rekoobe backdoor on compromised systems.
Linux backdoor/trojan that communicates with an attacker-controlled server to receive commands, download additional payloads, steal files, and provide reverse shell capability.
Linux backdoor delivered via a multi-stage supply-chain-driven dropper chain. In this campaign it is fetched from attacker infrastructure, executed on the victim host, and communicates outbound to 154[.]84[.]63[.]184 over TCP/443 using non-standard (non-TLS-handshake) traffic suggestive of custom encryption masquerading as HTTPS.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.