Emerging ThreatsMalware & Ransomware

Quasar Linux Malware Targets Developers with Stealthy Implant

Analyst 207||Source: BleepingComputer
Cluttered developer's workstation with laptop and tools in a softly lit open-plan office.
"it dynamically compiles rootkit shared objects and PAM backdoor modules on the target host using gcc [GNU Compiler Collection]." — Trend Micro researchers

That sentence, pulled from a Trend Micro analysis this week, captures the technical ingenuity and the operational focus of a newly observed Linux implant named Quasar Linux (QLNX). Trend Micro says QLNX is aimed squarely at developer and DevOps environments and brings together a suite of stealth, persistence, credential-theft, and lateral-movement capabilities that can be used to undermine software supply chains.

Where QLNX is landing: developer and cloud toolchains

Trend Micro reports the malware kit is being deployed in development and DevOps environments hosted on popular distribution and orchestration platforms — specifically naming npm, PyPI, GitHub, AWS, Docker, and Kubernetes. Those targets, the company warns, create a direct path for supply-chain abuse: compromised developer workstations can yield credentials and access used to publish trojanized packages or otherwise tamper with software delivery pipelines.

Stealth and persistence: in-memory operation, rootkits, and seven persistence vectors

QLNX was designed for long-term, low-noise presence on infected systems. According to Trend Micro, the implant runs in memory, deletes its original binary, wipes logs, spoofs process names, and clears forensic environment variables. It also uses seven distinct persistence mechanisms to ensure it reloads across processes and reappears if terminated: LD_PRELOAD, systemd units, crontab entries, init.d scripts, XDG autostart entries, and injection into '.bashrc' among them.

Stealth is layered. A userland LD_PRELOAD rootkit hooks libc functions to hide files, processes, and artifacts, while an eBPF-based kernel component conceals PIDs, file paths, and network ports. Trend Micro emphasizes that the userland rootkit is dynamically compiled on the infected host — the behavior captured in the opening quote.

What QLNX can do: the 58-command RAT and specialized modules

At its center is a RAT core described as a 58-command framework that maintains persistent communication with a command-and-control (C2) station over custom TCP/TLS or HTTP/S channels. The framework offers interactive shells, file and process management, system control, and networking operations. Around that core, Trend Micro documents discrete modules for credential access, surveillance, execution and injection, networking, filesystem monitoring, and more.

  • Credential access: harvesting SSH keys, browser-stored secrets, cloud and developer configuration files, /etc/shadow contents, and clipboard data; plus PAM-based backdoors that intercept and log plaintext authentication.
  • Surveillance: keylogging, screenshot capture, and clipboard monitoring.
  • Networking and lateral movement: TCP tunneling, SOCKS proxying, port scanning, SSH-based lateral movement, and a peer-to-peer mesh capability.
  • Execution techniques: process injection via ptrace and /proc/pid/mem and the in-memory execution of shared objects and BOF/COFF payloads.
  • Filesystem monitoring: real-time tracking using inotify.

Implications for developer environments and software supply chains

Trend Micro's analysis draws a direct line from QLNX's targeting to the supply-chain problem: by focusing on developer workstations, attackers can bypass many enterprise perimeter controls and seize the credentials that gate code repositories and distribution platforms. The company notes that this method mirrors recent supply-chain incidents where stolen developer credentials enabled the publication of malicious packages to public repositories.

Trend Micro has not published case studies tying QLNX to specific incidents or attributed the implant to any actor; the company reports that deployment volume and activity levels remain unclear. At the time of publication, only four security solutions detect QLNX's binary as malicious. Trend Micro has supplied indicators of compromise (IoCs) to help defenders identify infections.

What this means for technologists, developers, and enterprise DevOps

Technologists and security teams should note the combination of fileless persistence, runtime compilation of components, and kernel-level concealment — detection strategies that rely only on known disk artifacts will miss parts of QLNX's behavior. Trend Micro's provision of IoCs will be useful but, given the in-memory focus, teams will need runtime and telemetry approaches to spot activity.

Developers and open-source maintainers are explicitly in the crosshairs: Trend Micro lists npm, PyPI, and GitHub as deployment environments. The company warns that harvested developer credentials could be used to publish trojanized packages, echoing documented supply-chain abuse methodologies.

Enterprise DevOps and cloud teams should watch access tied to AWS, Docker, and Kubernetes platforms, since Trend Micro includes those environments among QLNX's targets and notes cloud and developer configuration files as items of interest for exfiltration.

Trend Micro's report lays out a technically sophisticated implant that is compact in concept but broad in capability. The company's findings — from the dynamic compilation of rootkit modules to the seven persistence paths and a 58-command RAT — describe a toolset built to hide, persist, and harvest the credentials that fuel modern software delivery. What remains unknown in the public record is how widespread QLNX is and which, if any, specific supply-chain incidents can be tied to its use; Trend Micro has not provided attribution or deployment metrics.

Read the original Trend Micro coverage at BleepingComputer: https://www.bleepingcomputer.com/news/security/new-stealthy-quasar-linux-malware-targets-software-developers/

Cloud SecurityDeveloper ToolsDevopsEmerging ThreatsSupply ChainMalware OperationsLinux MalwareQuasar LinuxStealthy ImplantGNU Compiler Collection
Related Intelligence

Continue Reading

Developer workstation with laptop and subtle signs of supply chain breach.

Miasma Malware Targets npm, GitHub in Expanded Supply Chain Attack

Over 550 GitHub repositories have been compromised in a massive supply-chain attack, with malware harvesting developer credentials and spreading across package registries and workflows. The attack has already infected numerous npm packages and one Go module, putting developer data at risk.

Analyst 207
Southeast Asian cityscape with industrial control system hinted in background.

China-Linked Hackers Deploy TinyRCT Backdoor in Southeast Asian Infrastructure Attacks

For years, a stealthy China-linked hacking group has been quietly targeting critical infrastructure in Southeast Asia, with a clear strategic interest in disrupting or monitoring key regional industries. Their sophisticated attacks have zeroed in on state-owned energy and government sectors, using a potent tool called the TinyRCT backdoor.

Analyst 207
Hotel front desk with computer workstation and blurred laptop screen in background.

Microsoft Uncovers ZIP Phishing Campaign Targeting Hotels with Node.js Implant

Microsoft warns of a sneaky ZIP phishing campaign that's been targeting hotels across Europe and Asia since April 2026, using photo-themed attachments to deliver a Node.js implant to front-desk machines. The cleverly crafted emails, often written in Japanese, Danish, or Dutch, use urgent and reputation-focused themes to trick recipients into opening the malicious attachments.

Analyst 207
Smartphone lies on a plain surface with a blurred background, screen off.

Cellebrite Tool Used by Russia on Jailed Activist's iPhone Despite Sales Cutoff

Despite Cellebrite's claims to have cut off sales to Russia, a shocking forensics trail on a jailed activist's iPhone reveals that the company's tool was used to extract data as recently as June 2021. This alarming discrepancy raises serious questions about Cellebrite's control over its technology.

Analyst 207