Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

New Linux malware found targeting mobile networks across the world

Red padlock open on electric circuits network dark red background.

Threat actors have been targeting telecom operators across the world in a stealthy, sophisticated espionage campaign, new research has found.

A report from BleepingComputer cites the findings of a security researcher with the alias HaxRob who found two versions of a previously unknown backdoor, uploaded to VirusTotal in late 2023. The backdoor is called GTPDOOR, and apparently, it targets a “very old Red Hat Linux version, indicating an outdated target.”

The backdoor was said to be targeting SGSN, GGSN, and P-GW, systems which are adjacent to the GPRS roaming eXchange (GRX) service. These services can grant the attackers direct access to a telecom’s core network which, in turn, would allow them to gather sensitive, private information. With the help of GTPDOOR, the attackers could set a new encryption key for C2 communications, write arbitrary data to a local file named “system.conf”, execute arbitrary shell commands and return the output back to the C2, specify which IP addresses can communicate with the compromised host, pull the ACL list, and finally, reset the malware

LightBasin returns

The backdoors were “largely undetected” by antivirus engines, BleepingComputer notes. 

The researcher attributed the backdoor to LightBasin, allegedly a Chinese threat actor, also known as UNC1945. It was first spotted by cybersecurity researchers Mandiant, back in 2016 and has, since then, been observed targeting the telecommunications sector at a global scale. 

The group has in-depth knowledge of telecommunications network architecture, and protocols, it was said, and emulated some of them to steal “highly specific information” from mobile communication infrastructure (for example, subscriber information and call metadata). 

A report from late 2021, researchers from CrowdStrike said LightBasin managed to attack 13 global telecoms in two years. 

To defend against such attacks, the researchers agree, businesses should watch out for unusual raw socket activities, unexpected process names, and malware indicators such as duplicate syslog processes. 

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.