GhostPenguin Backdoor With Zero-Detection Attacking Linux Servers Uncovered Using AI-Automated Tools
## Cybersecurity: GhostPenguin Backdoor Analysis
Cybersecurity: GhostPenguin Backdoor Analysis
A previously undocumented Linux backdoor, named GhostPenguin, has been identified and has evaded detection for over four months.
This multi-threaded C++ malware provides remote shell access and file-system operations via encrypted UDP, making it exceptionally difficult to detect with traditional security tools.
The malware was discovered through an advanced threat-hunting pipeline utilizing artificial intelligence to analyze zero-detection samples. GhostPenguin remained undetected on VirusTotal from Mon, Jul 7, 2025, until recently.
The malware's emergence highlights the challenges faced in tracking low-detection malware crafted from scratch. It employs minimal data transfers between infected hosts and command-and-control servers, further complicating detection efforts.
A previously undocumented Linux backdoor, named GhostPenguin, has been identified and has evaded detection for over four months.
Detection Evasion and Infection Mechanism
GhostPenguin uses RC5 encryption with a 16-byte session ID obtained during the initial handshake with the command-and-control server. The malware transmits its initial session request using an unencrypted UDP packet containing a placeholder ID, which is replaced by the server with an actual encryption key.
This session ID serves as the RC5 encryption key for all subsequent communications over UDP port 53. Upon execution, the malware resolves its execution context by obtaining the current user’s home directory and executable path. It creates a file named .temp in the user’s home directory containing its process ID to prevent multiple instances from running simultaneously.
Communication is established through a four-phase workflow: initialization, session ID request, registration and transmission of system information (IP address, hostname, OS version, and architecture), listening state, connection maintenance via heartbeat signals every 500 milliseconds, and task execution, which includes processing commands.
The infected system executes approximately 40 different commands, ranging from remote shell operations to comprehensive file and directory manipulation. All data transfers are segmented into multiple packets to accommodate UDP payload limitations, and unacknowledged packets are automatically retransmitted until the server confirms receipt.
Based on reporting by Cyber Security News.