Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential Harvesting (Backdoor.Linux.QLNX.A) — Threadlinqs Intelligence
As of 2026-05-30, Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential Harvesting (Backdoor.Linux.QLNX.A) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0456 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Quasar Linux (QLNX) is a previously undocumented full-featured Linux RAT disclosed by Trend Micro. The implant carries embedded C source for an LD_PRELOAD rootkit and a PAM backdoor as string
Trend Micro researchers Aliakbar Zahravi and Ahmed Mohamed Ibrahim disclosed QLNX (Quasar Linux), a fileless, full-featured Linux remote access trojan with rootkit, PAM backdoor, credential harvesting, keylogging, and peer-to-peer mesh networking capabilities. The implant was surfaced by the same TrendAI-driven threat hunting methodology previously credited with exposing the GhostPenguin backdoor and was characterized by an extremely low detection footprint at the time of disclosure.
QLNX is delivered as a 64-bit ELF PIE executable named quasar-implant (SHA-256 ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545, ~148 KB). It executes filelessly from memory, spoofs its process name, profiles the host to detect containerized environments, uses eBPF to hide specific processes, files, and network ports, and wipes system logs to defeat forensics. The malware embeds two complete C source files as string literals — a hide-process LD_PRELOAD rootkit and a PAM backdoor module — and writes them to randomized /tmp paths (/tmp/.hide_src_XXXXXX, /tmp/.pam_src_XXXXXX) before invoking the local gcc compiler to produce loadable shared objects (libsecurity.so.1, libsecurity_utils.so.1, libpam_cache.so, pam_security.so). The compiled rootkit is installed by appending its path to /etc/ld.so.preload so every dynamically-linked process loads it system-wide; the PAM backdoor is dropped into the PAM module directory and wired into /etc/pam.d configuration to intercept authentication.
The PAM backdoor accepts a hardcoded master password 'O$$f$QtYJK' that grants authentication for any local account regardless of /etc/shadow. Each successful or attempted credential pair is XOR-encrypted and appended to /var/log/.ICE-unix (a path designed to mimic the legitimate X11 ICE socket directory). QLNX's credential harvester performs targeted scraping of developer secret material across multiple ecosystems, including .npmrc, .pypirc, .git-credentials, .aws/credentials and config, .kube/config, .docker/config.json, .vault-token, Terraform local state and credentials, GitHub CLI tokens, .env files, SSH private keys, shell history, and Firefox browser profiles. This collection is engineered for software supply-chain compromise: with these tokens an operator can publish malicious packages to NPM or PyPI, pivot into AWS/GCP cloud accounts, access Kubernetes clusters, retrieve Vault secrets, or backdoor build artifacts inside CI/CD pipelines.
Command-and-control is implemented over a custom protocol tunneled in TLS, plus HTTPS and HTTP fallbacks, with peer-to-peer relaying between infected hosts via a routing table — turning a population of implants into a resilient mesh and complicating eradication because traffic can hop through neighboring infected hosts. Supported operator commands include shell execution, full file manager, process listing/termination, TCP connection control, screenshot capture, keystroke logging (raw /dev/input plus X11 fallback), clipboard exfiltration with SHA-256 deduplication, SSH lateral movement, port scanning, raw packet capture, SOCKS proxies and TCP tunneling, in-memory .so reflective loading (memfd/shm/tmpfile), process injection via /proc/pid/mem and ptrace, Beacon Object File (BOF/COFF) execution, real-time filesystem monitoring via inotify, timestomping, and privilege escalation via sudo/pkexec.
Persistence is multi-layered and redundant: a systemd unit (/etc/systemd/system/quasar_linux.service), an init.d script (/etc/init.d/quasar_linux), crontab @reboot entries, XDG autostart desktop entries, modifications to .bashrc, and the system-wide /etc/ld.so.preload entry that activates on every binary execution. Defenders should treat any host where /etc/ld.so.preload references a non-vendor shared object as compromised and triage immediately.
Attribution is currently unknown. The malware shows a high degree of operational sophistication (P2P mesh, BOF execution, eBPF-based hiding, on-host compilation of components) con
Weaknesses (CWE)
CWE-506, CWE-507, CWE-798, CWE-522, CWE-552, CWE-78
Target sectors: technology, software-development, open-source, devops, cloud-services, ci-cd, package-registries
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195, T1195.002, T1059.004, T1106, T1574.006, T1543.002, T1037.004, T1053.003, T1547.013, T1556.003