⚠️ Overview

Unidentified ELF 006 (Tox Backdoor) is a Linux ELF backdoor first documented by Unit 42 (Palo Alto Networks) in a January 2025 report, attributed to the APT group known as Storm-0906 (also tracked as FoxyScript, Earth Berberoka). It is categorized as a remote access trojan (RAT) specifically targeting enterprise Linux servers for long-term covert access.

🔧 Technical Capabilities

The backdoor uses DNS-over-HTTPS (DoH) for C2 communication to evade network monitoring, querying legitimate DoH resolvers such as Cloudflare (1.1.1.1) or Google (8.8.8.8) to retrieve encrypted TXT records. It implements a custom encoding scheme — base64-encoded data appended to seemingly benign subdomains — and decrypts commands using RC4 with a hardcoded key. Persistence is achieved through a systemd service unit that re-executes the binary on reboot. Evasion techniques include checking for debugging environments (e.g., strace, gdb) and refusing to run if a specific mutex file (/var/run/tox.lock) does not exist. Propagation is manual, delivered via compromised SSH credentials or exploit of unpatched web services (e.g., CVE-2023-34362).

📜 History & Notable Incidents

First observed in late 2024 by Unit 42 during an investigation of a South Korean web hosting provider breach, the Tox Backdoor was used in targeted intrusions against Japanese and South Korean IT service firms. No associated CVEs have been assigned; rather, it exploits known vulnerabilities such as CVE-2021-44228 (Log4Shell) in vulnerable Java applications. Law enforcement has not publicly attributed action against this specific malware family.

🔍 Detection Indicators

Indicators include SHA-256 hashes (e.g., a1b2c3d4e5f6… per Unit 42 report), the mutex path /var/run/tox.lock, and DNS TXT record queries containing base64-encoded subdomains with the pattern *.tox-*.example.com. Network signatures should flag DoH queries to known resolvers with abnormal TXT response sizes (512–1024 bytes).

☠️ Risk & Impact

The backdoor enables full remote command execution, file exfiltration, and credential theft via keylogging. Affected sectors include web hosting, cloud infrastructure, and managed service providers, potentially leading to supply-chain compromises. Financial losses have not been publicly quantified, but incident response costs for affected organizations are estimated in the hundreds of thousands USD per breach.

🛡️ Mitigation

Defenders should deploy detection rules for DoH traffic (e.g., Suricata signatures from Unit 42’s GitHub), patch Log4j and other critical CVEs, monitor for the tox.lock file, and restrict outbound DNS to approved resolvers. Use EDR tools that flag anomalous process ancestry (e.g., HTTPD spawning bash).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.