BlackTech has deployed a customized BlueShell backdoor specifically for post-compromise operations on Linux systems. BlueShell is an open-source remote access trojan (RAT) written in Go offering attackers remote shell access, file upload/download capabilities, and SOCKS5 proxy functionalities over a command-and-control (C2) channel. The modified version retains the core RAT functionality while incorporating campaign-specific enhancements like tailored configuration management, proxy-aware C2 communication protocols, and covert stealth mechanisms not found in the original public BlueShell project.
BlackTech Masks BlueShell Backdoor Operational deployment follows a staged strategy that begins with initial access via SSH lateral movement onto targeted Linux hosts.
This includes parameters like C2 IP address and port (e.g., HTTPS service on port 443), sleep intervals for reconnects, hostname filters, and enterprise proxy settings (address, port, optional credentials, and flags indicating use/authenticate via the proxy). To avoid casual scrutiny, the dropper employs the BlueShell variant, replacing argv[0] with a forged value like [kworker/12:12], making it appear as if the running process is a Linux kernel worker thread in system listings. On a live system, investigators might see what looks like a kernel worker using tools such as ps, but examining /proc/PID/exe reveals an anonymous or deleted executable rather than a legitimate kernel component, significantly complicating detection and analysis.
