GTPDOOR Malware Targets Linux Systems
Cyber investigators have detected a newly identified Linux malware named GTPDOOR, specifically engineered for deployment in proximity to GPRS roaming exchanges (GRX) within telecom networks. Notably, this malware distinguishes itself by utilizing the GPRS Tunnelling Protocol (GTP) for its command-and-control (C2) communications.
GPRS roaming facilitates subscribers in accessing GPRS services outside their home mobile network coverage area, achieved through a GRX transporting roaming traffic via GTP between the visited and home Public Land Mobile Network (PLMN).
Security researcher haxrob, who uncovered two GTPDOOR artifacts uploaded to VirusTotal from China and Italy, suggests a probable connection between the backdoor and a known threat actor named LightBasin (aka UNC1945). CrowdStrike disclosed this actor in October 2021 for orchestrating attacks on the telecom sector to pilfer subscriber information and call metadata.
GTPDOOR in Action
Upon execution, GTPDOOR initiates a process-name modification, disguising itself as '[syslog]' invoked from the kernel. It then suppresses child signals and establishes a raw socket, enabling the implant to receive UDP messages impacting the network interfaces.
In essence, GTPDOOR allows a threat actor with established persistence on the roaming exchange network to communicate with a compromised host by sending GTP-C Echo Request messages containing a malicious payload. This specialized GTP-C Echo Request message functions as a conduit to convey commands for execution on the infected machine, transmitting the results back to the remote host.
The researcher highlights that GTPDOOR can be discreetly probed from an external network, eliciting a response by sending a TCP packet to any port number. If the implant is active, a crafted empty TCP packet is returned, along with information on whether the destination port was open or responding on the host.
