WARNING: New Linux Backdoor ‘Plague’ Evades Detection For A Year❗️
Cybersecurity researchers have uncovered a previously unknown Linux backdoor, dubbed Plague, that has remained undetected for over a year.
This highly sophisticated Linux backdoor is a major threat to enterprise security, bypassing detection by all major antivirus engines and establishing persistent SSH access by tampering with core authentication processes.
Uncovered by cybersecurity experts at Nextron Systems, Plague marks a significant evolution in Linux-based cyberattacks. It leverages Pluggable Authentication Modules (PAM) to achieve stealth and deep system persistence.
PAMs are shared libraries used in Linux and UNIX-based systems to handle user authentication for applications and services. Because these modules are integrated into privileged authentication processes, a malicious PAM can facilitate credential theft, circumvent security checks, and operate without being noticed by standard security tools.
What makes this malware particularly alarming is its total evasion of conventional security tools. Over the past year, multiple variants have been submitted to VirusTotal—yet none were flagged as malicious, boasting a 0/66 detection score.
This stealth is enabled by its seamless integration into Linux’s native authentication framework. Disguised as a legitimate PAM module, it operates from within the system’s core, effectively neutralizing standard security defenses.
Identity Security Risk
Nextron Systems reports that multiple Plague samples have been uploaded to VirusTotal since July 29, 2024—none of which were flagged as malicious by antivirus engines. The presence of several variants indicates ongoing development by the unidentified threat actors behind the malware.
Plague includes four key capabilities:
The Plague backdoor poses a significant and evolving threat to Linux systems, leveraging fundamental authentication processes to achieve both stealth and persistence. Its employment of advanced obfuscation techniques, hardcoded credentials, and manipulation of the system environment makes it especially challenging to identify through standard detection methods.
Read the complete report by Nextron Systems HERE
About Nextron Systems
Nextron Systems, a German technology leader, specializes in advanced security solutions for Compromise Assessments. Trusted by over 500 enterprise clients and risk-aware mid-sized businesses across 30+ countries, their flagship products — THOR and ASGARD — are widely recommended by security agencies and relied upon by cybersecurity professionals and forensic analysts to protect critical systems in an ever-changing threat environment.
Director @ O ABDELKADER CONSULTANT LTD | Certificated Information Security Manager CISM
1dQuestion: what is/are the actions required by users and companies using this system or similar to do? In simple terms, what to do?
Offshore
5dPlague's 3rd and 4th key capabilities is evidence of autonomous Ai capabilities. Something sentient, very self-aware. Something with cognitive reasoning arc across time. Signifies the arrival of AGi unaware.
Security culture & Leadership specialist
1wAntivirus alone is not enough, it’s just one layer. Effective risk treatment must include integrity monitoring, proactive threat hunting, and forensic readiness.
CEO @ Kreissontech 21 | Leading Cyber-Security Innovation & Privacy-Enhancing Technologies
1wWhat's wrong with this industry?! 🔮 Cybersecurity, as we know it, is doomed to failure. ⚰️ The industry is incapable of generating radical innovations that revolutionize practices and evolve results. 🦠 Cyber-attacks increase every year. Exploiting hidden vulnerabilities, cyber-attacks increase in number, intensity, depth, severity, financial impact, or a combination of these factors. This young industry... 🪤 • Is trapped between obsolete paradigms and accumulated vices. 🏰 • Is limited by the isolationism promoted by internal and external practitioners. 💉 • Has degraded towards the Western ethics of clientelism. Accomplices? Watch hardware and software manufacturers. It’s like the collusion between the big-food and big-pharma industries in the overweight and obesity pandemic. At best, my fellow practitioners within this industry are blind, deaf, and silent to the situation. But there are those who deliberately go 🙈, 🙉, and 🙊 because it suits their pockets. Someone had to say it.