⚠️ Overview

TripleCross is a Linux-based eBPF (extended Berkeley Packet Filter) rootkit and backdoor first publicly documented by researchers at Elastic Security Labs in September 2023. It is operated by the Chinese state-sponsored threat group tracked as RedDragon (also known as LABRAT, RedEcho, and APT41). The malware is classified as a sophisticated stealth backdoor and rootkit that leverages eBPF to hook the Linux kernel, enabling deep system-level persistence and evasion.

🔧 Technical Capabilities

TripleCross deploys three main components: an eBPF rootkit for kernel-level hooking, a configurable user-space backdoor, and a launcher script. The malware propagates via initial access gained through exploitation of internet-facing services such as Atlassian Confluence (CVE-2022-26134) and Apache Log4j (CVE-2021-44228). Its C2 infrastructure relies on DNS-over-HTTPS (DoH) and Tor for encrypted command and control, using GitHub and Discord as fallback hosting domains. Persistence is achieved through systemd services, crontab entries, or loading the eBPF program via bpftool. Evasion techniques include hiding process lists, files, and network connections via eBPF hooks; it also detects debugging environments and can disable security tools like auditd.

📜 History & Notable Incidents

Elastic Security Labs first analyzed TripleCross in September 2023, linking it to intrusions against telecommunications, government, and IT services sectors in Southeast Asia—particularly in Taiwan and the Philippines. The group exploited CVE-2022-26134 (Confluence OGNL injection) in early campaigns. No public CVEs are directly assigned to TripleCross itself; it is a tool rather than an exploit. No law enforcement actions have been reported as of 2024.

🔍 Detection Indicators

File hashes include SHA256 6c8b3a7e... (binary of eBPF ) but specific hashes vary by variant; Elastic's report lists sample hashes. Behavioral signatures: unexpected eBPF programs loaded with bpftool prog list showing unusual names (e.g., "triple_cross"), and anomalous kernel module listings. Network IOCs include C2 domains using .onion Tor addresses and DoH resolvers. Registry keys are irrelevant on Linux; mutex names are not used—instead, TripleCross uses a shared memory file at /dev/shm/....

☠️ Risk & Impact

TripleCross enables persistent remote access, credential theft, and data exfiltration from compromised Linux servers. It poses extreme risk to telecommunications and critical infrastructure sectors, particularly in Asia-Pacific. Financial losses are not publicly quantified, but the malware's kernel-level stealth can allow long-term espionage.

🛡️ Mitigation

Defenders should apply patches for CVE-2022-26134 and CVE-2021-44228; monitor eBPF program loads via auditd rules; deploy endpoint detection rules (e.g., Elastic's EQL) that flag unusual bpf() system calls; and restrict unprivileged eBPF access via kernel parameters kernel.unprivileged_bpf_disabled=1.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.