Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential Harvesting (Backdoor.Linux.QLNX.A)
Quasar Linux (QLNX) (TL-2026-0456), also tracked as Quasar Linux, is a high-severity malware campaign, first published 2026-05-04. It has no confirmed attribution, affects Linux Foundation Linux (generic distributions), maps to 38 MITRE ATT&CK techniques (T1014, T1021.004, T1036.005), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0456
- Threat ID
- TL-2026-0456
- Also known as
- Quasar Linux, QLNX, Backdoor.Linux.QLNX.A, quasar-implant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-04
- Last reviewed
- 2026-05-04
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, open-source, devops, cloud-services, ci-cd, package-registries
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Quasar Linux (QLNX)
Malware and tooling: Backdoor.Linux.QLNX.A, QLNX (Quasar Linux)
Quasar Linux (QLNX) is a previously undocumented full-featured Linux RAT disclosed by Trend Micro. The implant carries embedded C source for an LD_PRELOAD rootkit and a PAM backdoor as string literals, dynamically compiles them on the target host with gcc, then deploys the rootkit via /etc/ld.so.preload for system-wide library interception. QLNX targets DevOps credentials (.npmrc, .pypirc, .git-credentials, .aws/credentials, .kube/config, .docker/config.json, .vault-token, Terraform, GitHub CLI, .env) enabling NPM/PyPI registry pushes, cloud pivoting, and CI/CD compromise. PAM backdoor uses inline hooking with hardcoded master password O$$f$QtYJK and XOR-encrypted credential logging to /var/log/.ICE-unix. P2P mesh between implants complicates eradication.
How Quasar Linux (QLNX) works
Trend Micro researchers Aliakbar Zahravi and Ahmed Mohamed Ibrahim disclosed QLNX (Quasar Linux), a fileless, full-featured Linux remote access trojan with rootkit, PAM backdoor, credential harvesting, keylogging, and peer-to-peer mesh networking capabilities. The implant was surfaced by the same TrendAI-driven threat hunting methodology previously credited with exposing the GhostPenguin backdoor and was characterized by an extremely low detection footprint at the time of disclosure.
QLNX is delivered as a 64-bit ELF PIE executable named quasar-implant (SHA-256 ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545, ~148 KB). It executes filelessly from memory, spoofs its process name, profiles the host to detect containerized environments, uses eBPF to hide specific processes, files, and network ports, and wipes system logs to defeat forensics. The malware embeds two complete C source files as string literals — a hide-process LD_PRELOAD rootkit and a PAM backdoor module — and writes them to randomized /tmp paths (/tmp/.hide_src_XXXXXX, /tmp/.pam_src_XXXXXX) before invoking the local gcc compiler to produce loadable shared objects (libsecurity.so.1, libsecurity_utils.so.1, libpam_cache.so, pam_security.so). The compiled rootkit is installed by appending its path to /etc/ld.so.preload so every dynamically-linked process loads it system-wide; the PAM backdoor is dropped into the PAM module directory and wired into /etc/pam.d configuration to intercept authentication.
The PAM backdoor accepts a hardcoded master password 'O$$f$QtYJK' that grants authentication for any local account regardless of /etc/shadow. Each successful or attempted credential pair is XOR-encrypted and appended to /var/log/.ICE-unix (a path designed to mimic the legitimate X11 ICE socket directory). QLNX's credential harvester performs targeted scraping of developer secret material across multiple ecosystems, including .npmrc, .pypirc, .git-credentials, .aws/credentials and config, .kube/config, .docker/config.json, .vault-token, Terraform local state and credentials, GitHub CLI tokens, .env files, SSH private keys, shell history, and Firefox browser profiles. This collection is engineered for software supply-chain compromise: with these tokens an operator can publish malicious packages to NPM or PyPI, pivot into AWS/GCP cloud accounts, access Kubernetes clusters, retrieve Vault secrets, or backdoor build artifacts inside CI/CD pipelines.
Command-and-control is implemented over a custom protocol tunneled in TLS, plus HTTPS and HTTP fallbacks, with peer-to-peer relaying between infected hosts via a routing table — turning a population of implants into a resilient mesh and complicating eradication because traffic can hop through neighboring infected hosts. Supported operator commands include shell execution, full file manager, process listing/termination, TCP connection control, screenshot capture, keystroke logging (raw /dev/input plus X11 fallback), clipboard exfiltration with SHA-256 deduplication, SSH lateral movement, port scanning, raw packet capture, SOCKS proxies and TCP tunneling, in-memory .so reflective loading (memfd/shm/tmpfile), process injection via /proc/pid/mem and ptrace, Beacon Object File (BOF/COFF) execution, real-time filesystem monitoring via inotify, timestomping, and privilege escalation via sudo/pkexec.
Persistence is multi-layered and redundant: a systemd unit (/etc/systemd/system/quasar_linux.service), an init.d script (/etc/init.d/quasar_linux), crontab @reboot entries, XDG autostart desktop entries, modifications to .bashrc, and the system-wide /etc/ld.so.preload entry that activates on every binary execution. Defenders should treat any host where /etc/ld.so.preload references a non-vendor shared object as compromised and triage immediately.
Attribution is currently unknown. The malware shows a high degree of operational sophistication (P2P mesh, BOF execution, eBPF-based hiding, on-host compilation of components) consistent with a well-resourced operator — likely either a financially motivated supply-chain operator targeting package maintainers or a state-aligned actor seeking persistent footholds on developer endpoints. Defenders responsible for OSS package maintainers, CI/CD infrastructure, and DevOps endpoints should hunt for the IOCs below immediately.
MITRE ATT&CK techniques used in TL-2026-0456
Defense Evasion
T1014 Rootkit; T1036.005 Match Legitimate Resource Name or Location; T1055.008 Process Injection: Ptrace System Calls; T1055.009 Process Injection: Proc Memory; T1070.006 Indicator Removal: Timestomp; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1564.001 Hide Artifacts: Hidden Files and Directories; T1620 Reflective Code Loading
Lateral Movement
T1021.004 Remote Services: SSH
Persistence
T1037.004 Boot or Logon Initialization Scripts: RC Scripts; T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service; T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries; T1556.003 Modify Authentication Process: Pluggable Authentication Modules
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Credential Access
T1056.001 Input Capture: Keylogging; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1649 Steal or Forge Authentication Certificates
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090.003 Proxy: Multi-hop Proxy; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573.002 Encrypted Channel: Asymmetric Cryptography
Collection
T1113 Screen Capture; T1115 Clipboard Data
Initial Access
T1195 Supply Chain Compromise; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Impact
Privilege Escalation
T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
stealth
T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
defense-impairment
Affected products and versions in Quasar Linux (QLNX)
- Linux Foundation — Linux (generic distributions)
Vulnerable versions: x86_64 Linux hosts with gcc available - OpenSSH / PAM — Pluggable Authentication Modules
Vulnerable versions: systems using PAM (most modern Linux distros) - npm, Inc. — npm CLI / .npmrc credentials
Vulnerable versions: any version with stored auth tokens - Python Software Foundation — PyPI / .pypirc credentials
Vulnerable versions: any version with stored API tokens - Amazon Web Services — AWS CLI credentials (~/.aws/credentials, ~/.aws/config)
Vulnerable versions: any - Cloud Native Computing Foundation — kubectl / kubeconfig (~/.kube/config)
Vulnerable versions: any - Docker, Inc. — Docker CLI (~/.docker/config.json)
Vulnerable versions: any - HashiCorp — Vault CLI / Terraform credentials (.vault-token, .terraformrc)
Vulnerable versions: any - GitHub — GitHub CLI tokens / .git-credentials
Vulnerable versions: any
Remediation for Quasar Linux (QLNX)
Patches
- No vendor patch — this is malware, not a CVE. Eradication requires complete host rebuild and credential rotation.
Immediate actions
- Inspect /etc/ld.so.preload on every Linux host; investigate any non-vendor entry as a confirmed compromise indicator
- Hunt for files matching the published QLNX SHA-256 hashes on developer workstations, build agents, and package-maintainer machines
- Check /var/log/.ICE-unix and /var/log/.Test-unix for the QLNX credential-log artifact (these paths should not exist as files)
- Audit /etc/pam.d configuration and the PAM module directory (/lib/security or /lib/x86_64-linux-gnu/security) for unknown modules such as pam_security.so, libpam_cache.so, libsecurity_utils.so.1
- Review /tmp for files matching .hide_src_*, .pam_src_*, .pcs_* — evidence of on-host compilation by QLNX
- Search systemd units and init.d scripts for 'quasar_linux' service names; remove and rebuild affected hosts
- Force rotation of every credential exposed to the host: NPM tokens, PyPI tokens, AWS keys, kubeconfig credentials, Docker Hub passwords, Git credentials, Vault tokens, Terraform credentials, GitHub CLI tokens, SSH keys, and any .env-stored secrets
- Block outbound traffic from developer endpoints to unknown TLS peers; alert on long-lived TCP from non-server hosts
- If a package maintainer is suspected compromised, audit recent NPM/PyPI publications for malicious versions and yank/unpublish as needed; rotate registry tokens
Workarounds
- Mount /tmp with noexec where workflow permits, to disrupt on-host compilation of the rootkit and PAM modules from /tmp paths
- Restrict gcc execution on production servers and developer endpoints with SELinux/AppArmor profiles
- Set /etc/ld.so.preload to immutable (chattr +i) on hardened hosts after baseline; alert on any change attempt
- Network-segment developer/CI hosts so they cannot establish arbitrary outbound TCP/TLS to internet peers
Longer-term hardening
- Treat developer and CI/CD endpoints as Tier 0 assets equivalent to domain controllers — harden with EDR/XDR, enforce MFA, and restrict outbound network egress
- Adopt hardware-bound credentials (FIDO2, OIDC short-lived tokens, instance roles) and eliminate long-lived static tokens in dotfiles where feasible
- Move package signing and registry publication into a hardened, isolated CI environment (signed builds, SLSA-style provenance) so a compromised maintainer workstation cannot directly publish
- Enforce baseline auditd and Falco rulesets that flag writes to /etc/ld.so.preload, modifications to PAM configuration, and gcc invocations under suspicious parents (curl, bash, sshd, etc.)
- Deploy file-integrity monitoring on /etc/ld.so.preload, /etc/pam.d/, /etc/systemd/system/, /etc/init.d/, and standard PAM module directories
- Implement application allow-listing on developer workstations and disable on-host compilers where business need does not require them
Weaknesses (CWE) in Quasar Linux (QLNX)
CWE-506, CWE-507, CWE-798, CWE-522, CWE-552, CWE-78
Timeline of Quasar Linux (QLNX)
- Trend Micro's TrendAI threat-hunting platform flags a low-detection Linux ELF implant for deeper analysis.
- Reverse engineering begins; researchers Aliakbar Zahravi and Ahmed Mohamed Ibrahim identify embedded C source for an LD_PRELOAD rootkit and a PAM backdoor stored as string literals inside the implant.
- Researchers confirm the implant invokes on-host gcc to compile its rootkit and PAM components from /tmp/.hide_src_* and /tmp/.pam_src_*, then installs the rootkit via /etc/ld.so.preload for system-wide library interception.
- Hardcoded PAM master password 'O$$f$QtYJK' identified in the backdoor; XOR-encrypted credential log artifact discovered at /var/log/.ICE-unix masquerading as legitimate X11 ICE socket directory.
- Credential harvester confirmed to target DevOps secrets — .npmrc, .pypirc, .git-credentials, .aws/credentials, .kube/config, .docker/config.json, .vault-token, Terraform, GitHub CLI, and .env files — establishing software supply-chain risk.
- P2P mesh routing capability between QLNX implants identified, allowing infected hosts to relay C&C traffic for one another and complicating eradication in environments with multiple compromised endpoints.
- Threadlinqs Intelligence (TL-2026-0456) publishes the threat with consolidated IOCs, MITRE mapping, detection content, and adversary simulation guidance.
- Trend Micro publishes the QLNX research blog with full IOC list, naming the family Quasar Linux (QLNX) and assigning detection name Backdoor.Linux.QLNX.A.
- As of 2026-05-29, QLNX (Quasar Linux) remains an active live threat: this fileless Linux RAT was disclosed by Trend Micro ~2026-05-04 and corroborated through 2026-05-08 (THN, BleepingComputer, SecurityWeek), with only ~4 AV engines detecting it. It is unattributed (no actor to disrupt), has no takedown or possible patch (malware, not a CVE), and is actively deployed against DevOps endpoints for supply-chain compromise.
Sources cited for Quasar Linux (QLNX)
- Quasar Linux (QLNX) – A Silent Foothold in the Software Supply Chain (Trend Micro)
- AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows (Trend Micro)
- MITRE ATT&CK T1574.006 — Hijack Execution Flow: Dynamic Linker Hijacking
- MITRE ATT&CK T1556.003 — Modify Authentication Process: Pluggable Authentication Modules
- MITRE ATT&CK T1014 — Rootkit
- MITRE ATT&CK T1552.001 — Unsecured Credentials: Credentials In Files
- MITRE ATT&CK T1195 — Supply Chain Compromise
- Linux Manual: ld.so(8) — /etc/ld.so.preload mechanism
Threats related to Quasar Linux (QLNX)
Detection coverage for TL-2026-0456
As of 2026-05-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0456 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.