New ‘Plague’ Malware Evades Detection for a Year, Hijacks Linux SSH Authentication

A newly uncovered Linux backdoor named Plague has been operating stealthily for over a year, providing attackers with persistent SSH access and the ability to bypass authentication mechanisms on infected systems.

PAM-Based Malware With Deep Integration

Discovered by researchers at Nextron Systems, Plague is a malicious Pluggable Authentication Module (PAM) that integrates directly into the system’s authentication stack. This deep integration allows it to survive updates and evade traditional detection techniques.

Once deployed, the malware enables attackers to authenticate using hardcoded credentials and gain root-level access through SSH without triggering standard access controls.

Stealth Through Environment Tampering

One of Plague’s most effective features is its ability to erase all signs of an attacker’s presence:

• It unsets environment variables such as SSH_CONNECTION and SSH_CLIENT
• Redirects HISTFILE to /dev/null, preventing shell command logging
• Cleans up session metadata and runtime artifacts, leaving no digital trace

This makes incident response and forensic investigation extremely difficult, even on closely monitored systems.

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

Anti-Analysis and Obfuscation Techniques

Plague uses several techniques to block analysis and reverse engineering:

• String obfuscation to evade detection by signature-based tools
• Anti-debugging mechanisms to crash or evade dynamic analysis
• Layered code obfuscation and indirect execution paths

These features allow the malware to operate in stealth, even under scrutiny.

Multiple Variants, Zero Detection

According to Nextron, multiple Plague samples have been uploaded to VirusTotal over the past year—none of which have been flagged as malicious by antivirus engines.

Artifacts left behind during compilation reveal use of different GCC versions across multiple Linux distributions, suggesting active development and wide deployment across environments.

A Threat to Core Linux Infrastructure

“Plague integrates deeply into the authentication stack, survives system updates, and leaves almost no forensic traces,” said Nextron researcher Pierre-Henri Pezier.

Its exploitation of core authentication infrastructure, combined with advanced evasion techniques, positions Plague as a serious threat to Linux environments, especially in enterprise or cloud infrastructure where PAM modules are standard.

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com

Source Link