Cybersecurity articles tagged #Linux Malware on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/clingstun-backdoor-exploits-24-iot-flaws-for-proxy-networkhttps://runtimerebel.com/blog/clingstun-backdoor-exploits-24-iot-flaws-for-proxy-networkThe ClingSTUN Linux backdoor exploits 24 known vulnerabilities in IoT devices, turning them into proxy nodes and using STUN servers to obscure communications.Tue, 06 Oct 2026 03:52:06 GMTIot SecurityLinux MalwareBackdoorProxy NetworkClingSTUNhttps://runtimerebel.com/blog/packagist-supply-chain-attack-8-packages-deliver-linux-malwarehttps://runtimerebel.com/blog/packagist-supply-chain-attack-8-packages-deliver-linux-malwareSecurity researchers identified a supply chain attack on Packagist involving eight infected packages that deploy Linux malware via GitHub Releases URLs.Sat, 23 May 2026 20:22:18 GMTPackagistComposerLinux MalwareSupply Chain AttackGitHubhttps://runtimerebel.com/blog/showboat-linux-malware-targets-middle-east-telecom-via-socks5-proxyhttps://runtimerebel.com/blog/showboat-linux-malware-targets-middle-east-telecom-via-socks5-proxyResearchers discover Showboat, a modular Linux post-exploitation framework used in Middle East telecom attacks to establish persistent SOCKS5 proxy backdoors.Thu, 21 May 2026 16:58:45 GMTShowboatLinux MalwareMiddle EastTelecomSOCKS5Black Lotus Labshttps://runtimerebel.com/blog/quasar-linux-rat-qlnx-targets-developers-for-supply-chain-attackshttps://runtimerebel.com/blog/quasar-linux-rat-qlnx-targets-developers-for-supply-chain-attacksA new Linux implant, Quasar Linux RAT (QLNX), targets developer systems for credential theft and network tunneling to compromise software supply chains.Fri, 08 May 2026 12:36:57 GMTQLNXQuasar Linux RATSupply Chain SecurityLinux MalwareCredential Thefthttps://runtimerebel.com/blog/stealthy-quasar-linux-qlnx-malware-targets-developershttps://runtimerebel.com/blog/stealthy-quasar-linux-qlnx-malware-targets-developersNew Quasar Linux (QLNX) malware is infecting developers' Linux systems, utilizing rootkit, backdoor, and credential-stealing techniques. Learn to detect and mitigate.Wed, 06 May 2026 00:46:50 GMTQuasar LinuxQLNXLinux MalwareRootkitBackdoorSoftware DevelopersCredential Thefthttps://runtimerebel.com/blog/masjesu-botnet-stealthy-ddos-malware-targets-linux-iot-deviceshttps://runtimerebel.com/blog/masjesu-botnet-stealthy-ddos-malware-targets-linux-iot-devicesMasjesu is a highly evasive DDoS botnet targeting Linux IoT devices. It prioritizes persistence and avoids critical infrastructure to remain undetected.Wed, 08 Apr 2026 12:27:42 GMTMasjesuIot SecurityDDoS BotnetLinux MalwarePersistence Mechanismshttps://runtimerebel.com/blog/us-authorities-disrupt-socksescort-proxy-and-avrecon-botnethttps://runtimerebel.com/blog/us-authorities-disrupt-socksescort-proxy-and-avrecon-botnetUS and international law enforcement dismantle the SocksEscort proxy network and AVRecon botnet, which hijacked over 100,000 Linux-based edge devices.Thu, 12 Mar 2026 16:28:53 GMTAVReconSocksEscortBotnet DisruptionLinux MalwareEdge Securityhttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyhttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyGoogle disrupts GRIDTIDE, a novel backdoor used by PRC-nexus UNC2814 for global cyber espionage against telecommunications and government entities.Wed, 25 Feb 2026 16:34:59 GMTUNC2814GRIDTIDEPRC NexusCyber EspionageTelecommunicationsGovernmentGoogle Sheets APISoftEther VPNC2Linux MalwareTTPs