New Stealthy Fileless Linux Malware Spreads Automatically

A sophisticated fileless Linux malware framework, ShadowHS, that represents a significant evolution in post-exploitation tooling.

Unlike traditional malware binaries, ShadowHS operates entirely in memory and demonstrates advanced operator-driven capabilities designed specifically for long-term persistence in defended enterprise environments.

ShadowHS is not a standalone malware binary but rather a heavily modified variant of the hackshell utility that has been weaponized into a full-featured intrusion framework.

The malware incorporates fileless execution as its core design principle, executing from anonymous file descriptors while spoofing process names to evade detection.

At no point during the infection chain does the payload write to disk, effectively bypassing traditional file-integrity monitoring and antivirus inspection mechanisms.

The infection begins with a multi-stage encrypted shell loader that employs AES-256-CBC encryption to protect its embedded payload.

Cyble Research & Intelligence Labs (CRIL) has identified a Linux intrusion chain leveraging a highly obfuscated, fileless loader that deploys a weaponized variant of hackshell entirely from memory. 

Upon execution, the loader validates runtime dependencies, including OpenSSL, Perl, and gzip, then dynamically determines its invocation context to guarantee correct payload execution.

The payload is reconstructed through a complex decoding pipeline and executed directly from memory via /proc//fd/ with a spoofed argv parameter, typically masquerading as legitimate processes like Python3.

Operator-Driven Design

What distinguishes ShadowHS from commodity malware is its deliberately restrained runtime behavior.

Rather than immediately deploying cryptominers or initiating data exfiltration, the framework prioritizes environmental reconnaissance, security control discovery, and operational safety.

This clear separation between initial restraint and extensive dormant functionality strongly suggests deliberate operator tradecraft rather than automated malware logic.

The payload performs aggressive fingerprinting of enterprise security solutions, including CrowdStrike Falcon Sensor, Sophos Intercept X, Cortex XDR, Microsoft Defender, Elastic Agent, Wazuh, Tanium, and multiple cloud vendor agents.

Both filesystem path checks and service-state enumeration are employed to detect these platforms, with results surfaced directly to operators for informed decision-making.

ShadowHS implements robust anti-competition logic designed to identify and terminate rival malware families including Rondo, Kinsing, and the notorious Ebury OpenSSH credential-stealing backdoor.

The framework actively hunts for competing cryptominers, detects kernel rootkits via loaded kernel module checks, and enumerates deleted or memfd-backed executables that may indicate prior compromise.

Additionally, the malware performs deep security posture introspection by examining kernel protections such as AppArmor, inspecting loaded modules, and surveying /proc for indicators of instrumentation.

One of ShadowHS’s most sophisticated capabilities involves operator-initiated data exfiltration that completely bypasses traditional network transports.

Instead of relying on SSH, SCP, or SFTP, the framework implements dedicated staging helpers that leverage GSocket user-space tunnels to establish covert channels.

File transfers are routed through a hardcoded GSocket rendezvous endpoint at 62.171.153[.]47, authenticated using operator-supplied tokens.

This technique replaces rsync’s standard transport layer with DBus-based or netcat-style GSocket tunnels, allowing data movement that evades firewall controls and endpoint monitoring.

The apparent loopback destination is deliberately misleading, as connections are intercepted by GSocket before reaching the local networking stack, enabling remote exfiltration without opening visible network sessions.

Mitigations

When operators choose to activate dormant capabilities, ShadowHS deploys multiple cryptocurrency mining workflows including XMRig, XMR-Stak with CUDA backends, GMiner using the Kawpow algorithm, and lolMiner targeting ETCHASH.

Mining operations connect to infrastructure at 204.93.253[.]180 with pool failover logic and dynamically sourced worker identifiers.

For lateral movement, the framework downloads Rustscan for SSH service discovery and spirit for automated brute-force attacks against identified endpoints.

The malware also contains dormant modules for credential theft targeting AWS credentials, SSH keys, GitLab, WordPress and Bitrix databases, Docker, Proxmox VMs, OpenVZ containers, and cloud platform metadata services.

Traditional signature-based and file-scanning security controls offer minimal protection against ShadowHS due to its fileless nature and memory-only execution model.

Effective detection requires visibility into in-memory execution patterns, process behavior analysis, and kernel-level telemetry.

Organizations should implement runtime application self-protection, memory scanning capabilities, and behavioral analytics to identify suspicious process genealogy and argument spoofing.

The discovery of ShadowHS underscores the evolution of Linux-targeted threats from opportunistic botnets toward sophisticated, operator-controlled frameworks designed for strategic compromise of enterprise infrastructure.

Its combination of advanced evasion techniques, comprehensive security awareness, and selective capability activation represents a mature post-exploitation platform optimized for long-term persistence rather than immediate impact.

Indicators of Compromise (IOCs)

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.