As cited
Copy frozen at (site build).
threat intel
Redtail Payload Analysis [Guest Diary]
A SANS researcher analyzed the RedTail Linux malware by executing multiple architecture-specific samples in an isolated environment and capturing their behavior through system call tracing, memory dumps, and network monitoring. The malware performed extensive host profiling to enumerate processor topology and virtualization details, established persistence via crontab entries, masked its process identity to mimic legitimate services like PHP-FPM, created dynamic TCP listeners, and actively killed analysis tools including filesystem monitors and strace. Despite receiving clear virtualization indicators, RedTail continued execution, suggesting that sandbox evasion detection alone may not be sufficient to halt modern Linux threats.
Why it matters: Linux system administrators and security teams must recognize that RedTail combines multiple evasion and persistence techniques that function across both unprivileged and root contexts, making it a threat to both development and production environments; the malware's active disruption of monitoring processes means standard detection tools may be silenced during an active infection.
- Source published
- First seen by Cybersecurity Tracker