Shades of Red: RedXOR Linux backdoor and its Chinese origins

This presentation by Joachim Kennedy and Avigile from Inteser reveals RedXOR, a sophisticated Linux backdoor attributed to the Chinese APT group Winter Umbrella.

**Linux Malware Landscape**: The speakers establish context by noting that while Linux has minimal desktop market share, it dominates cloud workloads, making it a prime target for financially motivated threat actors (coin miners, botnets, ransomware) and nation states including Russia (Turla, APT-29, Sofacy), North Korea (Lazarus/Hidden Cobra), and China (Black Tech, Winter Umbrella).

**RedXOR Capabilities**: RedXOR is a Linux backdoor offering multiple attack functions: reverse shell via Python PTY implementation, file manipulation (upload, download, delete), rootkit integration for process hiding, and reverse proxy capabilities using open source Redir. When discovered, it had minimal VirusTotal detections and was initially uploaded from Taiwan and Indonesia disguised as a Pokémon update.

**Rootkit Technology**: The speakers explain two Linux rootkit approaches. Userland-based rootkits use LD_PRELOAD to hook shared object functions before application startup, but fail against statically linked binaries. Kernel-level rootkits use Linux Kernel Modules (LKM), requiring kernel version matching and source availability on the target system. RedXOR uses Ador, an open source GitHub rootkit. The malware detects Ador by creating/removing a file under /proc and verifying the effective user ID against expected values.

**Malware Behavior**: Upon execution, RedXOR forks and detaches from shell (standard Linux malware evasion), checks root privileges to determine persistence location (.pocket.thumb directory under root or home directory), creates a mutex lock file, moves its binary into the hidden directory, and establishes persistence via init scripts. Configuration data—including C2 IP, port, and authentication password—is embedded and XOR-encoded using a custom 'duks' function where buffer length serves as the encryption key. All C2 communication occurs via HTTP POST to hardcoded paths like '/yester/login.jsp' with encoded payloads. Commands arrive via jsession attribute values: 0000 (system information), 1000 (ping), and others for file operations.

**Winter Umbrella Attribution**: The speakers establish multiple technical connections between RedXOR and other Winter Umbrella malware (Soridos, Paul Linux). Similarities include: identical pseudo-terminal implementation patterns, XML-based file listing using identical variables (name, path, time, size, user), similar /proc-based rootkit detection methods, use of ltchown with large invalid identifiers to hide files via rootkit communication, comparable XOR encoding schemes, and shared persistence mechanisms. Notably, while RedXOR uses Ador rootkit, other Winter Umbrella malware use Suteruso, yet evidence suggests they modified Suteruso to communicate via files—similar to Ador's approach—indicating shared rootkit knowledge across the group.

**Conclusion**: While most Linux attacks originate from financially motivated actors, this presentation demonstrates nation-state sophistication through stealth techniques, rootkit integration, and operational patterns linking RedXOR to China's Winter Umbrella APT.