# Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential Harvesting (Backdoor.Linux.QLNX.A)

> Quasar Linux (QLNX) is a previously undocumented full-featured Linux RAT disclosed by Trend Micro. The implant carries embedded C source for an LD_PRELOAD rootkit and a PAM backdoor as string literals, dynamically compiles them on the target host with gcc, then deploys the rootkit via /etc/ld.so.preload for system-wide library interception. QLNX targets DevOps credentials (.npmrc, .pypirc, .git-credentials, .aws/credentials, .kube/config, .docker/config.json, .vault-token, Terraform, GitHub CLI, .env) enabling NPM/PyPI registry pushes, cloud pivoting, and CI/CD compromise. PAM backdoor uses inline hooking with hardcoded master password O$$f$QtYJK and XOR-encrypted credential logging to /var/log/.ICE-unix. P2P mesh between implants complicates eradication.

- **Published:** 2026-05-04T12:00:00Z
- **Last reviewed:** 2026-05-04T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0456
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-quasar-linux-rat-tl-2026-0456.webp?v=a1b5ff1e (Threadlinqs threat intel: Quasar Linux (QLNX) LD_PRELOAD Rootkit: Detection & IOCs (TL-2026-0456) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-0456
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Trend Micro researchers Aliakbar Zahravi and Ahmed Mohamed Ibrahim disclosed QLNX (Quasar Linux), a fileless, full-featured Linux remote access trojan with rootkit, PAM backdoor, credential harvesting, keylogging, and peer-to-peer mesh networking capabilities. The implant was surfaced by the same TrendAI-driven threat hunting methodology previously credited with exposing the GhostPenguin backdoor and was characterized by an extremely low detection footprint at the time of disclosure.

QLNX is delivered as a 64-bit ELF PIE executable named quasar-implant (SHA-256 ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545, ~148 KB). It executes filelessly from memory, spoofs its process name, profiles the host to detect containerized environments, uses eBPF to hide specific processes, files, and network ports, and wipes system logs to defeat forensics. The malware embeds two complete C source files as string literals — a hide-process LD_PRELOAD rootkit and a PAM backdoor module — and writes them to randomized /tmp paths (/tmp/.hide_src_XXXXXX, /tmp/.pam_src_XXXXXX) before invoking the local gcc compiler to produce loadable shared objects (libsecurity.so.1, libsecurity_utils.so.1, libpam_cache.so, pam_security.so). The compiled rootkit is installed by appending its path to /etc/ld.so.preload so every dynamically-linked process loads it system-wide; the PAM backdoor is dropped into the PAM module directory and wired into /etc/pam.d configuration to intercept authentication.

The PAM backdoor accepts a hardcoded master password 'O$$f$QtYJK' that grants authentication for any local account regardless of /etc/shadow. Each successful or attempted credential pair is XOR-encrypted and appended to /var/log/.ICE-unix (a path designed to mimic the legitimate X11 ICE socket directory). QLNX's credential harvester performs targeted scraping of developer secret material across multiple ecosystems, including .npmrc, .pypirc, .git-credentials, .aws/credentials and config, .kube/config, .docker/config.json, .vault-token, Terraform local state and credentials, GitHub CLI tokens, .env files, SSH private keys, shell history, and Firefox browser profiles. This collection is engineered for software supply-chain compromise: with these tokens an operator can publish malicious packages to NPM or PyPI, pivot into AWS/GCP cloud accounts, access Kubernetes clusters, retrieve Vault secrets, or backdoor build artifacts inside CI/CD pipelines.

Command-and-control is implemented over a custom protocol tunneled in TLS, plus HTTPS and HTTP fallbacks, with peer-to-peer relaying between infected hosts via a routing table — turning a population of implants into a resilient mesh and complicating eradication because traffic can hop through neighboring infected hosts. Supported operator commands include shell execution, full file manager, process listing/termination, TCP connection control, screenshot capture, keystroke logging (raw /dev/input plus X11 fallback), clipboard exfiltration with SHA-256 deduplication, SSH lateral movement, port scanning, raw packet capture, SOCKS proxies and TCP tunneling, in-memory .so reflective loading (memfd/shm/tmpfile), process injection via /proc/pid/mem and ptrace, Beacon Object File (BOF/COFF) execution, real-time filesystem monitoring via inotify, timestomping, and privilege escalation via sudo/pkexec.

Persistence is multi-layered and redundant: a systemd unit (/etc/systemd/system/quasar_linux.service), an init.d script (/etc/init.d/quasar_linux), crontab @reboot entries, XDG autostart desktop entries, modifications to .bashrc, and the system-wide /etc/ld.so.preload entry that activates on every binary execution. Defenders should treat any host where /etc/ld.so.preload references a non-vendor shared object as compromised and triage immediately.

Attribution is currently unknown. The malware shows a high degree of operational sophistication (P2P mesh, BOF execution, eBPF-based hiding, on-host compilation of components) consistent with a well-resourced operator — likely either a financially motivated supply-chain operator targeting package maintainers or a state-aligned actor seeking persistent footholds on developer endpoints. Defenders responsible for OSS package maintainers, CI/CD infrastructure, and DevOps endpoints should hunt for the IOCs below immediately.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1106 Native API
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1543.002 Create or Modify System Process: Systemd Service
- T1037.004 Boot or Logon Initialization Scripts: RC Scripts
- T1053.003 Scheduled Task/Job: Cron
- T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries
- T1556.003 Modify Authentication Process: Pluggable Authentication Modules
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1014 Rootkit
- T1685.006 Clear Linux or Mac System Logs
- T1070.006 Indicator Removal: Timestomp
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1055.008 Process Injection: Ptrace System Calls
- T1055.009 Process Injection: Proc Memory
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1056.001 Input Capture: Keylogging
- T1649 Steal or Forge Authentication Certificates
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1021.004 Remote Services: SSH
- T1115 Clipboard Data
- T1113 Screen Capture
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1090.003 Proxy: Multi-hop Proxy
- T1572 Protocol Tunneling
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**QLNX — On-Host gcc Compilation From /tmp QLNX Source Patterns (Exploitation)** (`TL-2026-0456-SPL-001`)

Detects QLNX's hallmark exploitation/staging step: a gcc (or cc1) process compiling C source files matching the QLNX mktemp staging patterns (/tmp/.hide_src_*, /tmp/.pam_src_*, /tmp/.pcs_*) into shared objects (libsecurity.so.1, libsecurity_utils.so.1, libpam_cache.so, pam_security.so). Real QLNX implants ship the rootkit and PAM backdoor source as embedded string literals, drop them to randomized /tmp paths, and invoke the on-host gcc to produce loadable .so files prior to ld.so.preload installation. Any gcc invocation against these paths on a server, build agent, or production host is high-confidence QLNX activity.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1106, T1574.006
- **Data sources:** sysmon_linux, auditd, edr_process_events, microsoft_defender_for_endpoint_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux_endpoint sourcetype="linux:sysmon" OR sourcetype="linux:auditd" EventCode=1 (Image="*/gcc" OR Image="*/cc1" OR Image="*/cc")
| eval qlnx_src=if(match(CommandLine, "/tmp/\.(hide_src_|pam_src_|pcs_)"), 1, 0)
| eval qlnx_out=if(match(CommandLine, "(libsecurity(_utils)?\.so\.1|libpam_cache\.so|pam_security\.so)"), 1, 0)
| where qlnx_src=1 OR qlnx_out=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentImage) as parent_image values(User) as user by host, Image
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%S")
| where count > 0
| table _time host user Image parent_image cmdlines first_seen last_seen count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("gcc","cc1","cc") or FileName in~ ("gcc","cc1","cc")
| where ProcessCommandLine matches regex @"/tmp/\.(hide_src_|pam_src_|pcs_)"
   or ProcessCommandLine has_any ("libsecurity.so.1","libsecurity_utils.so.1","libpam_cache.so","pam_security.so")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| summarize Compiles=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Cmdlines=make_set(ProcessCommandLine, 10) by DeviceName, AccountName
| where Compiles >= 1
```

### Sigma

```yaml
title: QLNX On-Host gcc Compilation From /tmp Staging Sources
id: ed1f5b4a-9c0d-4b3e-8f2a-1c4d7e8b9a01
status: experimental
description: Detects gcc/cc1 process creation events whose command line references the QLNX (Backdoor.Linux.QLNX.A) mktemp staging patterns (/tmp/.hide_src_*, /tmp/.pam_src_*, /tmp/.pcs_*) or its emitted shared-object names (libsecurity.so.1, libpam_cache.so, pam_security.so). This is the on-host compilation stage of the QLNX kill chain, where the implant materializes its rootkit and PAM backdoor from embedded C source at runtime.
references:
    - https://www.trendmicro.com/en_us/research/26/e/quasar-linux-qlnx-a-silent-foothold-in-the-software-supply-chain.html
    - https://attack.mitre.org/techniques/T1059/004/
    - https://attack.mitre.org/techniques/T1106/
author: Threadlinqs Team
date: 2026/05/04
tags:
    - attack.execution
    - attack.t1059.004
    - attack.t1106
    - attack.defense_evasion
logsource:
    product: linux
    category: process_creation
detection:
    gcc_proc:
        Image|endswith:
            - '/gcc'
            - '/cc1'
            - '/cc'
    qlnx_src:
        CommandLine|contains:
            - '/tmp/.hide_src_'
            - '/tmp/.pam_src_'
            - '/tmp/.pcs_'
    qlnx_out:
        CommandLine|contains:
            - 'libsecurity.so.1'
            - 'libsecurity_utils.so.1'
            - 'libpam_cache.so'
            - 'pam_security.so'
    condition: gcc_proc and (qlnx_src or qlnx_out)
fields:
    - ParentImage
    - CommandLine
    - User
falsepositives:
    - Custom developer tooling that intentionally produces same-named shared objects (rare; verify ParentImage)
level: high
```

**Known false positives:**

- Legitimate developer compilation of similarly-named in-house shared objects (rare; investigate ParentImage and host role)
- Build agents executing CI jobs that intentionally write source under /tmp (verify CI job ID and parent process)

**Tuning notes:** Restrict to host classes where gcc execution is unexpected (production servers, package-maintainer workstations, container hosts). Whitelist by ParentImage for known-good build orchestrators (e.g., bazel, rpmbuild, dpkg-buildpackage). Lower the threshold to count >= 1 once whitelist is in place — a single match against a QLNX-pattern path on a non-build host is high-confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- QLNX — gcc Spawned By Non-Developer Parent (Exploitation Compilation Chain) (locked: unlock with TL Creds)
- QLNX — Unauthorized PAM Backdoor Module Drop In /lib/security (Post-Exploitation) (locked: unlock with TL Creds)
- QLNX — Single Process Sweeping Multiple DevOps Secret Dotfiles (Credential Access For Pivot) (locked: unlock with TL Creds)
- QLNX — Embedded C-Source Drop In /tmp Followed By gcc (Exploitation Staging) (locked: unlock with TL Creds)
- QLNX — [indicator] As Regular File (Credential-Log Masquerade & Hidden Artifact) (locked: unlock with TL Creds)
- QLNX — SSH Lateral Movement With Stolen DevOps Keys (C2/Lateral) (locked: unlock with TL Creds)
- QLNX — [indicator] Rootkit Installation (Post-Exploitation Persistence) (locked: unlock with TL Creds)
- QLNX — Long-Lived Outbound TLS From Developer/Build Hosts (P2P Mesh & C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- File hash: `ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545`
- File hash: `82daa93219ba40a6e41cdf3174ba57eb5d3383d1cd805584e9954eb0200182a1`
- File hash: `42d0c420eb5fe181388f2e4f0b7d7c0d302971e7a06fdc1bec481b68c8ccae1f`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Quasar Linux (QLNX) – A Silent Foothold in the Software Supply Chain (Trend Micro)](https://www.trendmicro.com/en_us/research/26/e/quasar-linux-qlnx-a-silent-foothold-in-the-software-supply-chain.html)
- [AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows (Trend Micro)](https://www.trendmicro.com/en_us/research/ghostpenguin.html)
- [MITRE ATT&CK T1574.006 — Hijack Execution Flow: Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [MITRE ATT&CK T1556.003 — Modify Authentication Process: Pluggable Authentication Modules](https://attack.mitre.org/techniques/T1556/003/)
- [MITRE ATT&CK T1014 — Rootkit](https://attack.mitre.org/techniques/T1014/)
- [MITRE ATT&CK T1552.001 — Unsecured Credentials: Credentials In Files](https://attack.mitre.org/techniques/T1552/001/)
- [MITRE ATT&CK T1195 — Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
- [Linux Manual: ld.so(8) — /etc/ld.so.preload mechanism](https://man7.org/linux/man-pages/man8/ld.so.8.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0456