GhostPenguin Malware
- GhostPenguin
Last reported 5 months ago, by Trend Micro Research2 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1014Rootkit
“Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities”
- T1036Masquerading
“Kernel thread name spoofing used by QLNX for process masquerading”
- T1055Process Injection
“Process injection via /proc/pid/mem and ptrace”
- T1056.001Keylogging
“Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features.”
- T1070.006Timestomp
“…o, then installs it via /etc/ld.so.preload, ensuring it is loaded into every dynamically-linked process that starts on the system, and timestomps itself against the real pam_unix.so to defeat forensic timeline analysis.”
- T1195Supply Chain Compromise
“The LiteLLM supply chain compromise in March 2026 followed exactly this pattern: stolen credentials from one tool were used to trojanize a Python package with 3.4 million daily downloads.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities“A clear example is our earlier work “AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows,” where AI-driven threat hunting helped us expose the previously elusive GhostPenguin backdoor.”
-
AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows“AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows”
Indicators in its reports
named in the reports above- 70f70743f287a837d17c56933152a8a6in 1 report
- b0f2c668cbdd63a8…3e931115872ein 1 report
- ea1d34b21b739a6b…1c8ead7c5545in 1 report
- 82daa93219ba40a6…4eb0200182a1in 1 report
- 42d0c420eb5fe181…1b68c8ccae1fin 1 report
- c99cf0dc1ef1057d…dcab39bbfacain 1 report
- ea89caab82181881…b5729fab8d33in 1 report
- 417430b2d4ae8d00…8ed1a70552ddin 1 report
- d55549d5655e2f20…f64cfa7facc8in 1 report
- 7d3bd0d04d3625322459dd9f11cc2ea3in 1 report
- 145da15a33b54e06…6c25f2701d50in 1 report
- 7b75ce1d60d3c38d…56aab98e9ab7in 1 report
- 65.20.72[.]101in 1 report
- 124.221.109[.]147in 1 report
- www.iytest[.]comin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.