{"id":6912,"date":"2024-01-31T06:15:18","date_gmt":"2024-01-31T06:15:18","guid":{"rendered":"\/cybersecurity-blog\/?p=6912"},"modified":"2024-01-31T07:02:43","modified_gmt":"2024-01-31T07:02:43","slug":"linux-malware-types-families-and-trends","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/","title":{"rendered":"Linux Malware: Types, Families and Trends\u00a0"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>You&#8217;re probably familiar with the tagline &#8220;America runs on Dunkin.&#8221; Well, if the writers who came up with it worked in the Free Software Foundation, they might as well say, &#8220;The Internet runs on Linux.&#8221; The only difference is that they&#8217;d be factually correct.&nbsp;<\/p>\n\n\n\n<p>Linux is the primary operating system for many application backends, including Apache and Nginx \u2014 systems responsible for delivering a large part of the internet&#8217;s content.&nbsp;<\/p>\n\n\n\n<p>In cloud computing, Linux is the operating system of choice for platforms like Amazon Web Services (AWS), Google Cloud Platform, and Microsoft Azure. Its lightweight and modular design allows Linux to operate on low-power devices, such as sensors, smart home gadgets, and wearables, which makes the OS ubiquitous in Internet of Things (IoT) devices: sensors, smart home gadgets, and wearables.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Linux malware is on the rise&nbsp;&nbsp;<\/h2>\n\n\n\n<p>Linux is often praised for being more secure and having fewer vulnerabilities out of the box compared to Microsoft Windows. This is true, but it doesn&#8217;t mean Linux is entirely invulnerable for malware.\u00a0\u00a0\u00a0<\/p>\n\n\n\n<p>Since 2018, there&#8217;s been a shift in focus among hackers who began developing new Lunux malware. As of March 2018, 15,762 new Linux malware variants were developed, a remarkably sharp increase from the 4,706 new variants developed by March 2017.\u00a0\u00a0<\/p>\n\n\n\n<p>And the IBM Security Report titled &#8220;Attacks on Industries Supporting COVID-19 Response Efforts Double&#8221; highlights: &#8220;Cybercriminals Accelerate Use of Linux Malware \u2013 With a 40% increase in Linux-related malware families in the past year, and a 500% increase in Go-written malware in the first six months of 2020, attackers are accelerating a migration to Linux malware.&#8221;&nbsp;<\/p>\n\n\n\n<p>This trend creates a massive risk to both companies and individuals.&nbsp;<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nANY.RUN provides the easiest way to analyze <span class=\"highlight\">Linux malware<\/span>&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/app.any.run\/#register\/\" rel=\"noopener\" target=\"_blank\">\nGet started free\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Most popular Linux threats&nbsp;&nbsp;<\/h2>\n\n\n\n<p>Linux malware can cause data leaks and encryption, resulting in financial damage. When it comes to malware families, they are essentially the same as those targeting Windows PCs:\u00a0<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Trojans<\/strong>: A <a href=\"https:\/\/any.run\/malware-trends\/trojan\" target=\"_blank\" rel=\"noreferrer noopener\">trojan<\/a> is malware disguised as legitimate software or embedded within another program. The term &#8220;trojan&#8221; doesn&#8217;t describe its function but refers to its delivery method.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Botnets: <\/strong><a href=\"https:\/\/any.run\/malware-trends\/botnet\" target=\"_blank\" rel=\"noreferrer noopener\">Botnets<\/a> are networks of devices controlled by a central command-and-control panel. They are often used in DDoS attacks to overwhelm target servers, causing system downtime. Often, botnets utilize IoT devices with online capabilities, which typically run on Linux.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Ransomware: <\/strong><a href=\"https:\/\/any.run\/malware-trends\/ransomware\" target=\"_blank\" rel=\"noreferrer noopener\">Ransomware<\/a> blocks access to your device or files and demands payment to restore your access. Your data remains encrypted and inaccessible until you pay for the decryption key.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Rootkits<\/strong>: Rootkits are a type of malware designed to be undetectable. Once installed, they can manipulate the operating system to hide other malware, change system functions, or deeply control system components. For example, a rootkit can conceal malware from antivirus software, falsely indicating that the system is clean.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cryptojacking: <\/strong>Cryptojacking malware hijacks a computer&#8217;s resources to mine cryptocurrency. Digital currencies like Bitcoin require &#8220;mining&#8221; \u2014 that&#8217;s when a computer is used to solve complex mathematical problems to validate transactions, earning currency in return. But mining is expensive \u2014 it requires powerful hardware and generates huge electricity bills. To avoid these costs, malicious actors infect other people&#8217;s computers, using their processing power without permission. This results in slower computer performance, higher energy use, and faster wear and tear on hardware.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Popular Linux malware families&nbsp;<\/h2>\n\n\n\n<p>In recent years numerous malware families targeting Linux systems emerged. Here are a few noteworthy ones:&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CloudSnooper&nbsp;<\/h3>\n\n\n\n<p>CloudSnooper is a sophisticated malware targeting Linux-based cloud environments that showcases a multifaceted approach to evasion and persistence. Its core functionality hinges on exploiting the iptables rules to create covert communication channels. Specifically, it manipulates these rules to allow traffic from a specific set of IP addresses, effectively bypassing standard firewall protections and enabling external C2 communication. Its rootkit capabilities enable deep system integration, concealing its presence by manipulating system calls and utilizing legitimate system binaries.\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Mirai&nbsp;<\/h3>\n\n\n\n<p>Mirai is a well-known IoT botnet that capitalizes on the vulnerabilities of devices with weak security protocols. It scans for and infects these devices using a list of common default credentials, subsequently integrating them into a network for DDoS attacks. Mirai can close network ports on infected devices to prevent further unauthorized access. This malware&#8217;s impact is amplified by the abundance of poorly secured IoT devices and its open-source nature.\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">RansomExx&nbsp;<\/h3>\n\n\n\n<p>RansomExx is a targeted ransomware strain known for attacks against enterprises and governments. It is easily identifiable by the &#8220;.ransomexx&#8221; extension, which it appends to encrypted files. The malware itself is not new, but it has only recently gained a Linux-targeting variant. The main attack vectors of this malware is spear-phishing, where it&#8217;s delivered to systems with IcedID trojan.\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">EvilGnome&nbsp;<\/h3>\n\n\n\n<p>EvilGnome is designed to masquerade as a GNOME shell extension, disguising itself to resemble legitimate GNOME processes. This approach allows it to remain largely undetected by conventional security tools. The modular design of this infostealer includes components for keylogging and downloading additional payloads, making it a popular tool for targeted espionage.\u00a0\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">GonnaCry&nbsp;<\/h3>\n\n\n\n<p>GonnaCry is another Linux-based ransomware. This one is written in Python. It encrypts files using the AES-256 algorithm and appends the &#8220;.GonnaCry&#8221; extension to them. Notably, GonnaCry operates without a command and control server, instead, it displays a ransom note with payment instructions directly to the user. This ransomware is known for being open-source, which potentially allows other cybercriminals to modify and repurpose it.\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tycoon&nbsp;<\/h3>\n\n\n\n<p>Tycoon is a multi-platform ransomware that targets both Windows and Linux systems, notable for its use of a Java-based file format to remain under the radar. It&#8217;s known to append unique extensions like &#8220;.redrum&#8221;, &#8220;.grinch&#8221;, or &#8220;.thanos&#8221;. Tycoon is deployed through targeted attacks, often exploiting weak security in remote desktop protocols. After infection, it compresses the files in a password-protected ZIP archive to hinder recovery efforts.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tools you can use to analyze Linux malware&nbsp;<\/h2>\n\n\n\n<p>Analyzing Linux malware accurately is essential for robust security. While there are several open-source network security toolkits available, none match the user-friendliness of <a href=\"http:\/\/any.run\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=linuxmalware&amp;utm_content=landing&amp;utm_term=310124\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>&#8216;s interactive sandbox, especially <a href=\"https:\/\/any.run\/cybersecurity-blog\/linux-in-anyrun\/\" target=\"_blank\" rel=\"noreferrer noopener\">with a new Ubuntu VM<\/a> available for everyone now. \u00a0<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nTry ANY.RUN for <span class=\"highlight\">Linux<\/span> with a free account&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/app.any.run\/#register\/\" rel=\"noopener\" target=\"_blank\">\nRegister now \n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p>However, expect changes soon, though we&#8217;re keeping the details under wraps for now.&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Rootkit Hunter &amp; Check Rootkit<\/strong>: These tools, <a href=\"http:\/\/rkhunter.sourceforge.net\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Rkhunter<\/a>, and <a href=\"http:\/\/www.chkrootkit.org\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">chkrootkit<\/a>, scan local systems to detect malicious software, including malware and viruses that conceal their presence on a system.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Volatility<\/strong>: <a href=\"https:\/\/en.wikipedia.org\/wiki\/Volatility_(memory_forensics)\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Volatility<\/a> is an open-source memory forensics framework designed for cloud security. It&#8217;s used in incident response and malware analysis.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Lynis<\/strong>: <a href=\"https:\/\/cisofy.com\/lynis\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Lynis<\/a> is a command-line tool that scans either local or remote systems. It helps auditors find potential network security issues.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Kali Linux<\/strong>: <a href=\"https:\/\/www.kali.org\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Kali Linux<\/a> is a distribution tailored for penetration testing, ethical hacking, and digital forensics. It includes a variety of security penetration and management tools for network discovery and research, helping to uncover cybersecurity vulnerabilities.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Closing thoughts on Linux security threats&nbsp;<\/h2>\n\n\n\n<p>Linux is inherently more secure than Windows, largely due to its robust open-source community. This community rigorously oversees resources and insists on transparency from companies developing Linux software, many of which are also open source.&nbsp;<\/p>\n\n\n\n<p>However, Linux&#8217;s widespread use, especially in cloud hosting, makes it an attractive target for attackers. Compromising Linux-based platforms could grant access to vast resources. Therefore, Linux users must be vigilant about the increasing risks their systems face. As we move forward into 2024, prioritizing system, data, and network security and maintenance is crucial \u2014 no matter the operating system.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>About ANY.RUN<\/strong>&nbsp;<\/h2>\n\n\n\n<p>ANY.RUN is a cloud malware sandbox that handles the heavy lifting of malware analysis for SOC and DFIR teams. Every day, 300,000 professionals use our platform to investigate incidents and streamline threat analysis.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p>Request a demo today and enjoy 14 days of free access to our Enterprise plan.&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/demo\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=linuxmalware&amp;utm_content=trial&amp;utm_term=310124\" target=\"_blank\" rel=\"noreferrer noopener\">Request demo \u2192<\/a>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>You&#8217;re probably familiar with the tagline &#8220;America runs on Dunkin.&#8221; Well, if the writers who came up with it worked in the Free Software Foundation, they might as well say, &#8220;The Internet runs on Linux.&#8221; The only difference is that they&#8217;d be factually correct.&nbsp; Linux is the primary operating system for many application backends, including [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":6919,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[15,34],"class_list":["post-6912","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifehacks","tag-malware","tag-malware-analysis"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Linux Malware: Types, Families and Trends\u00a0 - ANY.RUN&#039;s Cybersecurity Blog<\/title>\n<meta name=\"description\" content=\"From botnets to malware like CloudSnooper and GonnaCry, despite higher security than Windows Linux is still susceptible to malware.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"Linux Malware: Types, Families and Trends\u00a0\",\"datePublished\":\"2024-01-31T06:15:18+00:00\",\"dateModified\":\"2024-01-31T07:02:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/\"},\"wordCount\":1334,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"malware\",\"malware analysis\"],\"articleSection\":[\"Cybersecurity Lifehacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/\",\"name\":\"Linux Malware: Types, Families and Trends\u00a0 - ANY.RUN&#039;s Cybersecurity Blog\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2024-01-31T06:15:18+00:00\",\"dateModified\":\"2024-01-31T07:02:43+00:00\",\"description\":\"From botnets to malware like CloudSnooper and GonnaCry, despite higher security than Windows Linux is still susceptible to malware.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Lifehacks\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Linux Malware: Types, Families and Trends\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Linux Malware: Types, Families and Trends\u00a0 - ANY.RUN&#039;s Cybersecurity Blog","description":"From botnets to malware like CloudSnooper and GonnaCry, despite higher security than Windows Linux is still susceptible to malware.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"Linux Malware: Types, Families and Trends\u00a0","datePublished":"2024-01-31T06:15:18+00:00","dateModified":"2024-01-31T07:02:43+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/"},"wordCount":1334,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["malware","malware analysis"],"articleSection":["Cybersecurity Lifehacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/","url":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/","name":"Linux Malware: Types, Families and Trends\u00a0 - ANY.RUN&#039;s Cybersecurity Blog","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2024-01-31T06:15:18+00:00","dateModified":"2024-01-31T07:02:43+00:00","description":"From botnets to malware like CloudSnooper and GonnaCry, despite higher security than Windows Linux is still susceptible to malware.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-types-families-and-trends\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Lifehacks","item":"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/"},{"@type":"ListItem","position":3,"name":"Linux Malware: Types, Families and Trends\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/6912"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=6912"}],"version-history":[{"count":6,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/6912\/revisions"}],"predecessor-version":[{"id":6923,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/6912\/revisions\/6923"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/6919"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=6912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=6912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=6912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}