Chronicle, the cybersecurity arm of Google’s parent Alphabet, has identified and analyzed samples of the Winnti malware that have been designed specifically for the Linux platform. Believed to be operating out of China, the Winnti group was initially discovered in 2012, but is believed to have been operating since at least 2009, targeting software companies, particularly those in the gaming sector, for industrial cyber-espionage purposes. Recent reports suggested that various Chinese actors might be sharing tools, and the Winnti malware family too might have been used by multiple groups. The threat has been used in numerous attacks, with the most recent ones observed in April 2019. The Linux version of Winnti, Chronicle’s security researchers reveal , is comprised of the main backdoor (libxselinux) and a library (libxselinux.so) designed to hide the malicious activity on the infected system. The same as other variants of the malware, the Linux iteration was designed to handle ...
