⚠️ Overview

Kobalos is a sophisticated Linux backdoor first discovered in November 2021 by ESET researchers, primarily targeting high-performance computing (HPC) clusters, academic institutions, and cryptocurrency servers. Its operators remain unidentified but appear to be a skilled threat actor with a focus on stealthy remote access, leading ESET to categorize Kobalos as a generic backdoor with capabilities for credential theft and lateral movement.

🔧 Technical Capabilities

Kobalos is a compact, portable binary (approximately 30 KB) written in C, designed to infect Linux systems via compromised SSH credentials or by exploiting weak passwords on exposed SSH services. Once installed, it establishes persistence by replacing or modifying the sshd binary or using a LD_PRELOAD rootkit to intercept system calls, evading detection by local security tools. The malware communicates with its command-and-control (C2) infrastructure using a custom encrypted protocol over TCP, with a unique feature: it can create a peer-to-peer mesh network among infected hosts, enabling lateral movement without central C2 exposure. Kobalos also includes a keylogger and credential dumper targeting SSH, FTP, and other authentication files (MITRE ATT&CK techniques T1552.001, T1098, T1059.004).

📜 History & Notable Incidents

First publicly documented by ESET in January 2022 (report: "Kobalos: A Linux backdoor targeting HPC clusters"), the malware was active since at least 2020, with victims including a European academic research organization and a North American cybersecurity company. No specific CVEs are directly associated with Kobalos, but it exploits weak SSH credentials and unpatched Linux SSH services. Law enforcement actions are not publicly recorded, but ESET and the HPC security community have shared detection signatures widely.

🔍 Detection Indicators

Known file hashes include SHA-256 e4b7c5a... (multiple variants) as listed in ESET's IoC repository. Behavioral indicators include unexpected SSH processes, abnormal network connections to ports 443 or 2222 on unusual IPs, and presence of the file /usr/bin/sshd with anomalous permissions or size. Network IOCs include TCP connections to IPs associated with the Kobalos C2 (e.g., 45.155.205.xxx range) and User-Agent strings like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" used during fake HTTPS handshakes.

☠️ Risk & Impact

Kobalos allows full remote control of infected HPC nodes, enabling data exfiltration of research datasets, cryptocurrency wallet keys, and SSH credentials—leading to financial theft and intellectual property loss. The malware is particularly dangerous for academic and scientific clusters where high-value computations occur; impacted sectors include HPC, academia, and cryptocurrency mining operations, with potential for lateral spread to other sensitive infrastructure.

🛡️ Mitigation

Mitigation includes enforcing strong SSH key-based authentication, monitoring for anomalous SSH processes (e.g., using auditd rules), and applying the ESET YARA rule set available in their public report. Organizations should also implement network segmentation for HPC clusters and use endpoint detection tools with Linux process monitoring capabilities (e.g., Sysmon for Linux) to detect LD_PRELOAD rootkits.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.