[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRl0pBpb5lfK0lRKQM28SYcFvanZhF6WlUD9rpI1N18Q":3},{"article":4,"iocs":33,"watch_terms":37,"solutions":38,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"79903099-4112-4710-9f98-86f2a3582bf4","Malicious Linux Implants Mimic Asian Mail Security Products","malicious-linux-implants-mimic-asian-mail-security-products-13d969","A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it's hard to tell they're not.","Security researchers have identified a trio of Linux-based backdoors designed to evade detection by mimicking legitimate Asian mail security solutions. These implants use social engineering and supply chain tactics to appear as trusted edge security products, making them difficult to distinguish from authentic software. The discovery highlights a sophisticated threat campaign targeting organizations that rely on mail gateway security.","Researchers discover three Linux backdoors masquerading as Asian mail security products.","https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Fmalicious-linux-implants-mimic-asian-mail-security","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt6ae8adbdedb5109a\u002F6abeaf448f0ddb6d837f64ef\u002FFake_mustache-Liudmila_Chernetska-Getty.jpg?width=720&quality=80&disable=upscale","2026-10-02T13:00:00+00:00","2026-10-02T14:00:27.304328+00:00",7,[17,20],{"name":18,"type":19},"Linux","technology",{"name":21,"type":19},"Mail gateway security","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":22,"icon":24,"name":25,"slug":26},null,"Malware","malware",[28],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[34],{"type":26,"value":35,"context":36},"Linux backdoor (trio)","Three separate backdoor implants masquerading as Asian mail security products",[],{"controls":39,"vendors":124},[40,69,95],{"slug":41,"name":42,"problem":43,"products":44},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[45,53,61],{"vendor_slug":46,"vendor_name":47,"vendor_logo":48,"product_slug":49,"product_name":50,"url":51,"description":52},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":70,"name":71,"problem":72,"products":73},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[74,82,88],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":83,"product_name":84,"url":86,"description":87},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":70,"product_name":92,"url":93,"description":94},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"slug":96,"name":97,"problem":98,"products":99},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[125],{"slug":62,"name":63,"logo_path":64,"roles":126},[127],"reported_by",{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":144},"malicious-linux-backdoors-impersonate-legitimate-mail-security-products","Malicious Linux Backdoors Impersonate Legitimate Mail Security Products","Threat actors deployed three Linux-based implants engineered to mimic trusted Asian mail security solutions, exploiting the inherent trust organizations place in established edge security products. By blending into the appearance of legitimate software, the attackers leveraged supply chain deception and social engineering to bypass detection controls. This campaign underscores the danger of assuming that software resembling a known vendor product is inherently safe, particularly at the network perimeter. Organizations without robust software integrity verification and behavioral monitoring are especially vulnerable to this class of attack. The sophistication of this threat demonstrates that attackers are increasingly targeting the tools meant to protect organizations, turning defenders' own security stack against them.",[133,134,135,136,137,138,139,140,141,142,143],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-7: Monitoring for Unauthorized Software","NIST SP 800-128: Configuration Management of Information Systems","NIST AC-3: Access Enforcement","NIST SI-7: Software, Firmware, and Information Integrity","ISO\u002FIEC 27001: A.12.5 Control of Operational Software","MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1036: Masquerading",{}]