PamDOORa: Commercialized PAM-Abuse Backdoor for SSH Credential Theft on Linux — Evolution of the Plague / pam_exec Technique Lineage

PamDOORa: Commercialized PAM-Abuse Backdoor for SSH (TL-2026-1772), also tracked as PamDOORa, is a high-severity malware campaign, first published 2026-07-30. It has no confirmed attribution, affects linux-pam project / Linux distributions generally Pluggable, maps to 13 MITRE ATT&CK techniques (T1014, T1021, T1027), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-1772

Threat ID
TL-2026-1772
Also known as
PamDOORa, Plague (predecessor backdoor), SLAPSTICK (related historical PAM backdoor)
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-30
Last reviewed
2026-07-30
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
financial services, managed service providers, government administration, technology, critical infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
30

Malware and tooling in PamDOORa: Commercialized PAM-Abuse Backdoor for SSH

Malware and tooling: CAKETAP, PamDOORa, Plague, SLAPSTICK, TINYSHELL

PamDOORa is a commercialized Linux backdoor sold since at least April 2026 on the Rehub cybercrime forum by the actor 'darkworm' that abuses the Pluggable Authentication Module (PAM) framework — via pam_exec and, historically, modified pam_unix.so — to harvest SSH credentials and grant attackers persistent, stealthy authentication bypass. It is a direct technical descendant of the 'Plague' PAM backdoor (Nextron Systems, August 2025) and Group-IB's 2024-2025 PAM-abuse research, and mirrors PAM-backdoor tradecraft (SLAPSTICK, CAKETAP, TINYSHELL) used for years by the financially motivated, Mandiant-tracked group UNC2891 in ATM-fraud intrusions.

How PamDOORa: Commercialized PAM-Abuse Backdoor for SSH works

Provenance note: this threat ID's original HUNT seed (an 'XMRig Covert Ops'/pam_rootok-abuse claim attributed to Group-IB) was independently re-verified during RESEARCH and confirmed unverifiable/fabricated (no corroborating source anywhere, an invalid 66-character 'SHA-256' hash, and a suspicious same-day 'publish date'). Rather than fabricate data to force that fake narrative through, RESEARCH substituted Group-IB's actual, multi-outlet-corroborated 2026 PAM-abuse coverage — the real threat the fake content appears to have been garbled from — and documented it here in full, using only independently verified facts.

PamDOORa is a Linux post-exploitation backdoor first publicly reported on 7-8 May 2026 by Flare researcher Assaf Morag and Group-IB's DFIR team after it surfaced as a commercial listing (initially priced at $1,600, discounted to $900 by 9 April 2026) on the Russian-language cybercrime forum Rehub, offered by the actor 'darkworm'. The tool weaponizes the Linux Pluggable Authentication Module (PAM) stack — specifically the pam_exec module, which is designed to run external commands during authentication events — by injecting malicious directives into PAM configuration files such as /etc/pam.d/sshd. During SSH login attempts, the injected script harvests PAM environment variables (PAM_USER, PAM_RHOST, PAM_SERVICE) plus usernames, timestamps, and other session data, and exfiltrates them in plaintext to an attacker-controlled server, typically via netcat. Because the malicious pam_exec entry is set with the 'optional' control flag, execution neither breaks the login flow nor raises suspicion, and because operators deliberately trigger the script on failed authentication attempts, standard authentication logs record only a routine failed login — leaving no visible trace of the underlying credential exfiltration in application-level logs.

PamDOORa is not a novel technique in isolation: it is the latest commercialized iteration of a PAM-abuse lineage that Group-IB DFIR researchers Vito Alfano and Nam Le Phuong first documented on 6 September 2024 in 'The Duality of the Pluggable Authentication Module,' describing the same pam_exec-based approach (using a script named tn.sh to exfiltrate PAM_RHOST/PAM_SERVICE/PAM_USER data to a demonstration listener at 10.0.0.142:1234) as a technique 'not yet included in the MITRE ATT&CK framework' at that time. In the interim, Nextron Systems (Pierre-Henri Pezier) publicly disclosed a closely related, more sophisticated backdoor dubbed 'Plague' on 1 August 2025: a malicious PAM module masquerading as libselinux.so.8 (and later libse.so) that bypasses SSH authentication entirely via hardcoded 'magic' passwords, uses layered XOR/RC4-style/DRBG string obfuscation, performs anti-debug and anti-sandbox checks, and scrubs SSH_CONNECTION/SSH_CLIENT environment variables and shell history (HISTFILE redirected to /dev/null) to erase forensic evidence. Plague samples had circulated on VirusTotal undetected by all antivirus engines since July 2024, with active development continuing through at least March 2025.

The broader PAM-backdoor technique family also has a well-established track record in financially motivated operations: Group-IB's 8 May 2025 report 'Understanding Credential Harvesting via PAM' documents how UNC1945 and, more extensively, UNC2891 (both tracked by Mandiant) modify pam_unix.so to log plaintext credentials to hidden files as part of long-running, multi-year intrusions into Solaris and Linux estates. UNC2891 combined its SLAPSTICK PAM backdoor (hardcoded per-server 'magic password' enabling passwordless SSH access) with the CAKETAP Solaris/Linux kernel rootkit, which manipulates ATM switch authorization messages (ARQC/ARPC) to approve fraudulent card transactions, and a custom variant of the public TINYSHELL backdoor — together forming the toolset behind an attempted multi-bank ATM cash-out operation. PamDOORa's emergence as an off-the-shelf, purchasable product signals that this previously bespoke, APT-grade PAM-abuse tradecraft is now commoditizing for a broader criminal buyer base, and defenders of any Linux/OpenSSH estate using PAM (which is effectively all mainstream Linux distributions) should treat PAM configuration and module integrity as a first-class monitoring surface.

MITRE ATT&CK techniques used in TL-2026-1772

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow

Lateral Movement

T1021 Remote Services

Exfiltration

T1041 Exfiltration Over C2 Channel

Command and Control

T1105 Ingress Tool Transfer

Credential Access

T1556 Modify Authentication Process

defense-impairment

T1556 Modify Authentication Process; T1685 Disable or Modify Tools

Persistence

T1556 Modify Authentication Process

Impact

T1565 Data Manipulation

stealth

T1574 Hijack Execution Flow

Affected products and versions in PamDOORa: Commercialized PAM-Abuse Backdoor for SSH

  • linux-pam project / Linux distributions generally — Pluggable Authentication Modules (PAM) framework
    Vulnerable versions: Any Linux distribution with pam_exec or pam_unix.so enabled and insufficiently restricted PAM configuration/module file permissions
    Fixed in: No vendor patch applies — mitigated via configuration hardening and integrity monitoring, not a software fix
  • OpenSSH — sshd (PAM-integrated authentication path)
    Vulnerable versions: Any version configured with UsePAM yes and a writable /etc/pam.d/sshd
    Fixed in: N/A — hardening-based mitigation only (disable password/PAM-based auth in favor of SSH keys)

Remediation for PamDOORa: Commercialized PAM-Abuse Backdoor for SSH

Patches

  • No vendor CVE or patch applies — this is abuse of legitimate, documented PAM functionality (pam_exec, module loading) rather than a software vulnerability

Immediate actions

  • Audit /etc/pam.d/* configuration files (especially sshd, passwd, login) for unauthorized pam_exec directives or unexpected module entries
  • Compute and compare sha256sum hashes of pam_unix.so and all loaded PAM shared objects against known-good baselines to detect recompiled/replaced modules
  • Hunt for ELF binaries masquerading as libselinux.so.8 or libse.so outside their expected system library paths, and for any bkr=1-style flag variables

Workarounds

  • Restrict write permissions on /etc/pam.d/ and PAM module directories to root-only, tightly monitored accounts
  • Remove or explicitly restrict pam_exec.so usage on systems where it is not operationally required

Longer-term hardening

  • Deploy file-integrity monitoring (AIDE, Auditd with DISA-STIG rules) on /etc/pam.d/ and PAM shared-library directories
  • Enforce SSH key-based authentication (PasswordAuthentication no, ChallengeResponseAuthentication no) so PAM's credential-based authentication path — and its exposure to interception — is bypassed entirely
  • Enable SELinux/AppArmor mandatory access control to restrict which processes can load or modify PAM modules
  • Deploy rkhunter for rootkit detection and centralize authentication-log/SIEM correlation to catch failed-login bursts that mask exfiltration activity

Weaknesses (CWE) in PamDOORa: Commercialized PAM-Abuse Backdoor for SSH

CWE-798, CWE-288, CWE-306

Timeline of PamDOORa: Commercialized PAM-Abuse Backdoor for SSH

  • Earliest known Plague backdoor sample (masquerading as libselinux.so.8) first submitted to VirusTotal, undetected by all antivirus engines.
  • Group-IB DFIR (Vito Alfano, Nam Le Phuong) publish 'The Duality of the Pluggable Authentication Module,' documenting the pam_exec-based PAM persistence backdoor technique as 'not yet included in the MITRE ATT&CK framework.'
  • Additional Plague/libselinux.so.8 backdoor sample submitted to VirusTotal, indicating continued active development.
  • Plague variant sample compiled as 'libse.so' submitted to VirusTotal.
  • Group-IB publishes 'Understanding Credential Harvesting via PAM: A Real-World Threat,' documenting historical UNC1945 and UNC2891 pam_unix.so credential-theft tradecraft.
  • Nextron Systems researcher Pierre-Henri Pezier publicly discloses the 'Plague' PAM-based Linux backdoor for the first time, noting zero antivirus detections across all historical VirusTotal submissions.
  • Plague disclosure is corroborated and republished across multiple independent outlets (SecurityAffairs, TheHackerNews, Wiz Threats, ThaiCERT, CSO Online).
  • PamDOORa listing price is reduced from $1,600 to $900 on the Rehub Russian-language cybercrime forum by seller 'darkworm.'
  • Flare researcher Assaf Morag and Group-IB DFIR identify and report 'PamDOORa,' a commercialized evolution of the Plague/pam_exec PAM-abuse technique being sold on underground forums.
  • The Hacker News, GBHackers, CyberPress, CyberSecurityNews, and Rescana publish coverage of the PamDOORa backdoor disclosure.

Sources cited for PamDOORa: Commercialized PAM-Abuse Backdoor for SSH

Threats related to PamDOORa: Commercialized PAM-Abuse Backdoor for SSH

Detection coverage for TL-2026-1772

As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1772 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats