Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Linux backdoors have been discovered targeting telecom and network appliances in South Korea and Taiwan. The malware disguises its network traffic to resemble legitimate email services and processes to evade detection. Threat actors employ a defense evasion technique of naming malicious software after legitimate operating system components or processes. By borrowing names of real binaries, the malware blends into normal system activity. The campaign specifically focuses on telecom and network infrastructure sectors in the targeted regions. This represents a sophisticated approach to maintaining persistence while avoiding security tools.