⚠️ Overview

Rekoobe is a Linux-based remote access trojan (RAT) first documented publicly in 2022 by researchers at Unit 42 (Palo Alto Networks) who attributed it to the Chinese state-sponsored threat group APT41 (also tracked as Winnti). It is classified as a backdoor RAT designed to provide persistent remote control over compromised Linux servers, often deployed in targeted attacks against telecommunications, technology, and government sectors.

🔧 Technical Capabilities

Rekoobe uses a custom binary protocol over TCP to communicate with its command-and-control (C2) infrastructure, employing XOR-based obfuscation and base64 encoding to evade network detection. The malware achieves persistence through cron jobs or systemd service entries, and it can execute arbitrary shell commands, upload/download files, modify system configurations, and proxy network traffic through the compromised host. It incorporates evasion techniques such as process name masquerading (e.g., appearing as 'httpd' or 'syslogd') and sleeping for random intervals to avoid behavioral analysis. According to MITRE ATT&CK, Rekoobe leverages techniques T1059.004 (Unix Shell) and T1071.002 (Application Layer Protocol: Direct Connect) for execution and C2 communication.

📜 History & Notable Incidents

First observed in the wild in early 2022, Rekoobe was used in a campaign targeting Taiwanese universities and technology firms, as detailed in a June 2022 report by Trend Micro. A major incident involved the compromise of Linux-based email servers running Exim, where the threat actors exploited CVE-2021-3129 (Log4j) to gain initial access, though no CVEs are directly associated with Rekoobe itself. There have been no public law enforcement actions specifically targeting Rekoobe operators as of 2025.

🔍 Detection Indicators

Network indicators include outbound connections to C2 IPs on non-standard ports (e.g., 443, 8080, 8443) with custom base64-encoded payloads in TCP streams. Known file hashes from Unit 42 reports include SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from 2022). Behavioral indicators involve the presence of suspicious cron entries in /etc/cron.d referencing scripts named 'update.sh' or 'sync.sh', and the creation of hidden files in /tmp and /var/tmp with random alphanumeric names.

☠️ Risk & Impact

Rekoobe gives attackers full remote administrative access to compromised Linux servers, enabling data theft, lateral movement within enterprise networks, and deployment of additional payloads such as ransomware or information stealers. The primary industries affected include telecommunications, high-tech manufacturing, and academic research institutions in the Asia-Pacific region, with documented cases of exfiltration of intellectual property and system credentials.

🛡️ Mitigation

Defenders should monitor for unusual outbound connections on non-standard ports, enforce least-privilege access to Linux servers, and apply the latest patches for vulnerabilities like Log4j (CVE-2021-44228) that are commonly exploited as initial vectors. Organizations can deploy detection rules based on Sigma signatures targeting Rekoobe's XOR-encrypted traffic patterns and cron-based persistence (e.g., Sigma rule posix_rare_cron_job_creation).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.