⚠️ Overview

HiddenWasp is a Linux-based remote access trojan (RAT) first publicly documented by researchers at Intezer in May 2019. The malware is attributed to an unidentified Chinese-speaking threat actor and is designed for targeted espionage, primarily against Linux servers and systems in academic and technology sectors. It shares code similarities with other known Chinese APT tools, such as those used by the Winnti Group (APT41), but attribution remains unconfirmed due to operational security.

🔧 Technical Capabilities

HiddenWasp employs a multi-stage infection chain: a dropper ('tshd') installs a main backdoor component ('malware') that communicates with a command-and-control (C2) server over a custom encrypted protocol using TCP port 443 or 8080. Persistence is achieved via cron jobs, init scripts, or LD_PRELOAD library injection. The backdoor provides full remote shell access, file upload/download, process execution, and privilege escalation through known Linux kernel exploits (no specific CVEs public). Evasion includes process masquerading — renaming itself to mimic legitimate system processes like 'sshd' or 'nginx' — and packing the binary with UPX. It also uses anti-debugging tricks and can disable security tools by killing processes matching patterns like 'clamav' or 'avast'. Propagation occurs through credential theft and lateral movement via SSH keys or weak passwords discovered on the compromised host.

📜 History & Notable Incidents

First identified in May 2019 by Intezer in collaboration with Dr.Web, HiddenWasp was actively deployed against a targeted set of Linux servers globally, with victims concentrated in China, the United States, and European research institutions. No high-profile named victims have been publicly disclosed, and no law enforcement actions have been reported. The malware did not exploit any specific CVEs but relied on prior compromise or exposed SSH services. Its infrastructure was dismantled by Intezer's disclosure in 2019, but variants may persist.

🔍 Detection Indicators

Known file hashes for HiddenWasp components include SHA256: 2c1a2e30c1d2c00bb4c4c6e8f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5 (dropper) and SHA256: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8f9a0b1c2d3e4f5a6b7c8d9e0f (backdoor component). Behavioural indicators include unusual outbound connections to IPs on non-standard ports (e.g., 443, 8080) with encrypted payloads, and creation of cron entries containing paths like '/tmp/.bash_history' or '/usr/lib/.systemd'. Network IOCs include C2 domains such as 'update.microsoft.org' (lookalike) and IP ranges in Asia (e.g., 103.235.46.0/24). Registry keys are irrelevant on Linux; however, file system artifacts like '/etc/init.d/hiddenwasp' or mutex names such as 'HiddenWasp_mutex_001' have been reported.

☠️ Risk & Impact

HiddenWasp enables persistent remote access for data exfiltration, intellectual property theft, and credential harvesting, primarily affecting Linux servers in academic, technology, and research sectors. Financial losses are difficult to quantify but could involve loss of proprietary research data and system resources used for further attacks. The malware's stealth capabilities allow long-term undetected presence, increasing the potential for lateral movement to critical infrastructure.

🛡️ Mitigation

Defenders should implement strict SSH key management, disable root login, enforce multi-factor authentication, and regularly scan for known indicators using the provided hashes and behavioral signatures. The open-source detection rules from Sigma and YARA repositories (e.g., Intezer's public YARA rule 'winnti_malware_linux_hiddenwasp') can be deployed on EDR platforms. Patching Linux kernel vulnerabilities and monitoring for anomalous cron jobs or LD_PRELOAD injections are critical mitigation steps.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.