Researchers have identified Linux-based backdoors targeting telecom and network appliances in South Korea and Taiwan. The malware disguises its network traffic and process names as legitimate email services to blend in with normal administrative traffic and evade endpoint and network security controls. The campaign highlights the ongoing use of defense-evasion techniques that borrow legitimate binary names to avoid detection.

Which products are affected?

Telecom and network appliances in South Korea and Taiwan (specific models and vendors unconfirmed in reporting)

What should defenders do?

Security teams are advised to monitor for anomalous traffic patterns that mimic email service behavior, particularly on network appliances and telecom infrastructure. Update endpoint detection and response (EDR) rules to detect process names and command-line arguments that impersonate legitimate email binaries. Implement network segmentation to limit lateral movement from compromised appliances. Apply the principle of least privilege to administrative accounts managing network infrastructure. Review security logs for connections or processes that reference email service names but exhibit unusual behavior or originate from unexpected sources. As no specific vendor patch has been identified, focus on detection and behavioral analysis is currently the primary recommended action.

highMalware

Linux Backdoors Disguised as Email Security Tools Target Telecom Infrastructure in Korea and Taiwan

Threat actors impersonate legitimate processes to evade detection and maintain persistent access to network appliances

CyberIntel DeskPublished about 2 hours agoUpdated less than a minute ago1 min read

Linux Backdoors Disguised as Email Security Tools Target Telecom Infrastructure in Korea and Taiwan

Key Takeaways

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising traffic as email services and legitimate processes.
The malware employs defense evasion techniques by borrowing legitimate binary names and mimicking email service traffic to avoid detection.

Related Security News

highMalware

ClickFix Attacks Evolve to Better Hide Malicious Payloads

Threat actors have updated their ClickFix social engineering campaign to conceal malicious payloads using DNS TXT records and browser cache pre-fetching techniques. These changes make early detection more difficult, though the core social engineering lure remains unchanged. Security teams are advised to monitor for anomalous DNS activity and browser behavior as part of a layered defense.

Dark readingabout 2 hours ago1 min read