PamDOORa: Commercialized PAM-Abuse Backdoor for SSH Credential Theft on Linux — Evolution of the Plague / pam_exec Technique Lineage

Key facts for PamDOORa Rehub PAM backdoor

Detection coverage for PamDOORa Rehub PAM backdoor

As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1772 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PAM Configuration File Tampering — pam_exec Injection into sshd/passwd/login (PamDOORa/Plague)

Detects a write/rename to /etc/pam.d/sshd, /etc/pam.d/passwd, or /etc/pam.d/login correlated with the writing process, matching the PamDOORa/Plague/Group-IB 'Duality of PAM' technique of injecting an 'optional'-flagged pam_exec directive to run an attacker harvester script during SSH authentication events.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1556, T1574
• Data sources: auditd, linux_secure_log, file_integrity_monitoring (AIDE)
• Severity: high
• Confidence: high

Splunk SPL

index=linux_audit sourcetype=auditd type=PATH
| eval target_path=name
| where like(target_path, "/etc/pam.d/sshd") OR like(target_path, "/etc/pam.d/passwd") OR like(target_path, "/etc/pam.d/login")
| join type=inner _time host
    [ search index=linux_audit sourcetype=auditd type=SYSCALL syscall IN ("open","openat","rename","write")
      | eval writer_exe=exe, writer_uid=uid
      | table _time host writer_exe writer_uid ]
| stats count min(_time) as first_seen max(_time) as last_seen values(writer_exe) as writer_exe values(writer_uid) as writer_uid by host, target_path
| where count > 0
| eval alert="Unauthorized write to PAM config file — possible pam_exec backdoor injection (PamDOORa/Plague, T1556/T1574)"
| table first_seen, last_seen, host, target_path, writer_exe, writer_uid, count, alert

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "/etc/pam.d/" and FileName in~ ("sshd","passwd","login")
| where ActionType in ("FileModified","FileCreated","FileRenamed")
| extend Editor = InitiatingProcessFileName
| project Timestamp, DeviceName, FolderPath, FileName, ActionType, Editor, InitiatingProcessAccountName, InitiatingProcessCommandLine
| summarize ModCount = count(), Editors = make_set(Editor), Accounts = make_set(InitiatingProcessAccountName) by DeviceName, FolderPath, FileName
| where ModCount >= 1

Sigma

title: PAM Configuration File Tampering — Potential PamDOORa/Plague pam_exec Backdoor Injection
id: 6a1e9d3c-2f4b-4a7e-9c3d-1772000a0001
status: experimental
description: Detects modification of PAM configuration files (/etc/pam.d/sshd, passwd, login) consistent with injection of a malicious 'optional'-flagged pam_exec directive used by PamDOORa/Plague/Group-IB-documented PAM-abuse backdoors to harvest SSH credentials.
references:
    - https://www.group-ib.com/blog/pluggable-authentication-module/
    - https://thehackernews.com/2026/05/new-linux-pamdoora-backdoor-uses-pam.html
    - https://www.nextron-systems.com/2025/08/01/plague-a-newly-discovered-pam-based-backdoor-for-linux/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-30
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.credential-access
    - attack.t1556
    - attack.t1556.003
    - attack.t1574
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'PATH'
        name|contains:
            - '/etc/pam.d/sshd'
            - '/etc/pam.d/passwd'
            - '/etc/pam.d/login'
    condition: selection
falsepositives:
    - Legitimate PAM hardening/config management via Ansible, Puppet, or manual sysadmin change control
level: high

Known false positives:

• Legitimate PAM hardening or configuration-management pushes (Ansible/Puppet/Chef) touching /etc/pam.d/*
• Manual sysadmin edits during authorized change-control windows

Tuning notes: Baseline known configuration-management service accounts/processes (e.g. ansible, puppet-agent) and suppress alerts where writer_exe matches an approved CM tool; keep the alert live for interactive shells (bash/vi/sed) or unknown binaries writing these paths.

• 🔒 PAM Configuration File Tampering — pam_exec Injection into sshd/passwd/login (PamDOORa/Plague) · unlock with TL Creds
• 🔒 Library Masquerading as [indicator]/[indicator] Outside Standard Paths (Plague Backdoor) · unlock with TL Creds
• 🔒 sshd-Spawned Shell/Netcat Child with Outbound Connection — PamDOORa/Plague Exfil Channel & SSH Lateral Movement · unlock with TL Creds
• 🔒 PAM Configuration File Tampering — pam_exec Injection into sshd/passwd/login (PamDOORa/Plague) · unlock with TL Creds
• 🔒 File Masquerading as [indicator] / [indicator] Outside Expected Library Path (Plague Backdoor) · unlock with TL Creds
• 🔒 sshd-Spawned Shell/Netcat Child Process — Potential PamDOORa/Plague Exfiltration Channel · unlock with TL Creds
• 🔒 Anti-Forensic PAM Session Scrub — HISTFILE/SSH Env Var Suppression Post-Auth (Plague/PamDOORa) · unlock with TL Creds
• 🔒 sshd-Spawned Shell/Netcat Child with Outbound Connection — PamDOORa/Plague Exfil Channel & SSH Lateral Movement · unlock with TL Creds

Indicators of compromise for PamDOORa Rehub PAM backdoor

As of 2026-07-30, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-1772.

Sample indicators (3 of 30)

• File hash: 85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb
• File hash: 7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e
• File hash: 9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How PamDOORa Rehub PAM backdoor works

It is a direct technical descendant of the 'Plague' PAM backdoor (Nextron Systems, August 2025) and Group-IB's 2024-2025 PAM-abuse research, and mirrors PAM-backdoor tradecraft (SLAPSTICK, CAKETAP, TINYSHELL) used for years by the financially motivated, Mandiant-tracked group UNC2891 in ATM-fraud intrusions.

Provenance note: this threat ID's original HUNT seed (an 'XMRig Covert Ops'/pam_rootok-abuse claim attributed to Group-IB) was independently re-verified during RESEARCH and confirmed unverifiable/fabricated (no corroborating source anywhere, an invalid 66-character 'SHA-256' hash, and a suspicious same-day 'publish date'). Rather than fabricate data to force that fake narrative through, RESEARCH substituted Group-IB's actual, multi-outlet-corroborated 2026 PAM-abuse coverage — the real threat the fake content appears to have been garbled from — and documented it here in full, using only independently verified facts.

PamDOORa is a Linux post-exploitation backdoor first publicly reported on 7-8 May 2026 by Flare researcher Assaf Morag and Group-IB's DFIR team after it surfaced as a commercial listing (initially priced at $1,600, discounted to $900 by 9 April 2026) on the Russian-language cybercrime forum Rehub, offered by the actor 'darkworm'. The tool weaponizes the Linux Pluggable Authentication Module (PAM) stack — specifically the pam_exec module, which is designed to run external commands during authentication events — by injecting malicious directives into PAM configuration files such as /etc/pam.d/sshd. During SSH login attempts, the injected script harvests PAM environment variables (PAM_USER, PAM_RHOST, PAM_SERVICE) plus usernames, timestamps, and other session data, and exfiltrates them in plaintext to an attacker-controlled server, typically via netcat. Because the malicious pam_exec entry is set with the 'optional' control flag, execution neither breaks the login flow nor raises suspicion, and because operators deliberately trigger the script on failed authentication attempts, standard authentication logs record only a routine failed login — leaving no visible trace of the underlying credential exfiltration in application-level logs.

PamDOORa is not a novel technique in isolation: it is the latest commercialized iteration of a PAM-abuse lineage that Group-IB DFIR researchers Vito Alfano and Nam Le Phuong first documented on 6 September 2024 in 'The Duality of the Pluggable Authentication Module,' describing the same pam_exec-based approach (using a script named tn.sh to exfiltrate PAM_RHOST/PAM_SERVICE/PAM_USER data to a demonstration listener at 10.0.0.142:1234) as a technique 'not yet included in the MITRE ATT&CK framework' at that time. In the interim, Nextron Systems (Pierre-Henri Pezier) publicly disclosed a closely related, more sophisticated backdoor dubbed 'Plague' on 1 August 2025: a malicious PAM module masquerading as libselinux.so.8 (and later libse.so) that bypasses SSH authentication entirely via hardcoded 'magic' passwords, uses layered XOR/RC4-style/DRBG string obfuscation, performs anti-debug and anti-sandbox checks, and scrubs SSH_CONNECTION/SSH_CLIENT environment variables and shell history (HISTFILE redirected to /dev/null) to erase forensic evidence. Plague samples had circulated on VirusTotal undetected by all antivirus engines since July 2024, with active development continuing through at least March 2025.

The broader PAM-backdoor technique family also has a well-established track record in financially motivated operations: Group-IB's 8 May 2025 report 'Understanding Credential Harvesting via PAM' documents how UNC1945 and, more extensively, UNC2891 (both tracked by Mandiant) modify pam_unix.so to log plaintext credentials to hidden files as part of long-running, multi-year intrusions into Solaris and Linux estates. UNC2891 combined its SLAPSTICK PAM backdoor (hardcoded per-server 'magic password' enabling passwordless SSH access) with the CAKETAP Solaris/Linux kernel rootkit, which manipulates ATM switch authorization messages (ARQC/ARPC) to approve fraudulent card transactions, and a custom variant of the public TINYSHELL backdoor — together forming the toolset behind an attempted multi-bank ATM cash-out operation. PamDOORa's emergence as an off-the-shelf, purchasable product signals that this previously bespoke, APT-grade PAM-abuse tradecraft is now commoditizing for a broader criminal buyer base, and defenders of any Linux/OpenSSH estate using PAM (which is effectively all mainstream Linux distributions) should treat PAM configuration and module integrity as a first-class monitoring surface.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow

Lateral Movement

T1021 Remote Services

Exfiltration

T1041 Exfiltration Over C2 Channel

Command and Control

T1105 Ingress Tool Transfer

Credential Access

T1556 Modify Authentication Process

defense-impairment

T1556 Modify Authentication Process; T1685 Disable or Modify Tools

Persistence

T1556 Modify Authentication Process

Impact

T1565 Data Manipulation

stealth

T1574 Hijack Execution Flow

Remediation for PamDOORa Rehub PAM backdoor

Patches

• No vendor CVE or patch applies — this is abuse of legitimate, documented PAM functionality (pam_exec, module loading) rather than a software vulnerability

Immediate actions

• Audit /etc/pam.d/* configuration files (especially sshd, passwd, login) for unauthorized pam_exec directives or unexpected module entries
• Compute and compare sha256sum hashes of pam_unix.so and all loaded PAM shared objects against known-good baselines to detect recompiled/replaced modules
• Hunt for ELF binaries masquerading as libselinux.so.8 or libse.so outside their expected system library paths, and for any bkr=1-style flag variables

Workarounds

• Restrict write permissions on /etc/pam.d/ and PAM module directories to root-only, tightly monitored accounts
• Remove or explicitly restrict pam_exec.so usage on systems where it is not operationally required

Longer-term hardening

• Deploy file-integrity monitoring (AIDE, Auditd with DISA-STIG rules) on /etc/pam.d/ and PAM shared-library directories
• Enforce SSH key-based authentication (PasswordAuthentication no, ChallengeResponseAuthentication no) so PAM's credential-based authentication path — and its exposure to interception — is bypassed entirely
• Enable SELinux/AppArmor mandatory access control to restrict which processes can load or modify PAM modules
• Deploy rkhunter for rootkit detection and centralize authentication-log/SIEM correlation to catch failed-login bursts that mask exfiltration activity

Affected and fixed versions

• linux-pam project / Linux distributions generally — Pluggable Authentication Modules (PAM) framework
  Vulnerable versions: Any Linux distribution with pam_exec or pam_unix.so enabled and insufficiently restricted PAM configuration/module file permissions
  Fixed in: No vendor patch applies — mitigated via configuration hardening and integrity monitoring, not a software fix
• OpenSSH — sshd (PAM-integrated authentication path)
  Vulnerable versions: Any version configured with UsePAM yes and a writable /etc/pam.d/sshd
  Fixed in: N/A — hardening-based mitigation only (disable password/PAM-based auth in favor of SSH keys)

Timeline of PamDOORa Rehub PAM backdoor

• 2024-07-29 Earliest known locked-ioc-29 backdoor sample (masquerading as locked-ioc-14) first submitted to VirusTotal, undetected by all antivirus engines.
• 2024-09-06 Group-IB DFIR (locked-ioc-16, locked-ioc-15) publish 'The Duality of the Pluggable Authentication Module,' documenting the pam_exec-based PAM persistence backdoor technique as 'not yet included in the MITRE ATT&CK framework.'
• 2025-02-04 Additional locked-ioc-29/locked-ioc-14 backdoor sample submitted to VirusTotal, indicating continued active development.
• 2025-03-22 locked-ioc-29 variant sample compiled as 'locked-ioc-23' submitted to VirusTotal.
• 2025-05-08 Group-IB publishes 'Understanding Credential Harvesting via PAM: A Real-World Threat,' documenting historical locked-ioc-28 and locked-ioc-27 locked-ioc-19 credential-theft tradecraft.
• 2025-08-01 Nextron Systems researcher locked-ioc-11 publicly discloses the 'locked-ioc-29' PAM-based Linux backdoor for the first time, noting zero antivirus detections across all historical VirusTotal submissions.
• 2025-08-04 locked-ioc-29 disclosure is corroborated and republished across multiple independent outlets (SecurityAffairs, TheHackerNews, Wiz Threats, ThaiCERT, CSO Online).
• 2026-04-09 locked-ioc-24 listing price is reduced from $1,600 to $900 on the Rehub Russian-language cybercrime forum by seller 'locked-ioc-25.'
• 2026-05-07 Flare researcher locked-ioc-17 and Group-IB DFIR identify and report 'locked-ioc-24,' a commercialized evolution of the locked-ioc-29/pam_exec PAM-abuse technique being sold on underground forums.
• 2026-05-08 The Hacker News, GBHackers, CyberPress, CyberSecurityNews, and Rescana publish coverage of the locked-ioc-24 backdoor disclosure.

Sources cited for PamDOORa Rehub PAM backdoor

• The Duality of the Pluggable Authentication Module group-ib.com · Vendor report · 2024-09-06
• Understanding Credential Harvesting via PAM: A Real-World Threat group-ib.com · Vendor report · 2025-05-08
• Plague: A Newly Discovered PAM-Based Backdoor for Linux nextron-systems.com · Vendor report · 2025-08-01
• Plague PAM-Based Backdoor for Linux Wiz · Research · 2025-08-04
• New Rootkit Used by UNC2891 for ATM Money Heist FortiGuard Labs · Vendor report · 2022-04-28
• Caketap en.wikipedia.org · Research · 2022-04-28
• New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials The Hacker News · News · 2026-05-08
• New 'Plague' PAM Backdoor Exposes Critical Linux Systems The Hacker News · News · 2025-08-01
• Pam Backdoor Targets Linux Systems to Steal SSH Credentials gbhackers.com · News · 2026-05-08
• Researchers Warn Of PamDOORa Backdoor Attacking Linux Systems cyberpress.org · News · 2026-05-07
• New Linux backdoor Plague bypasses auth via malicious PAM module securityaffairs.com · News · 2025-08-04
• New 'Plague' Backdoor for Linux Hijacks SSH Using Malicious PAM Module cyberinsider.com · News · 2025-08-02

Threats related to PamDOORa Rehub PAM backdoor

• Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network

Previous and next in malware

• Tax Season Phishing and Malware Campaign Targets Indian Taxpayers via Fake Income Tax Department Notices Previous report
• OctLurk and SilkLurk Backdoors: Unattributed Chinese-Speaking Actor Cyberespionage Campaign Targeting Central Asian Government and Critical Infrastructure Next report