Snap-Happy Trojan Targets Linux Servers

Security researchers at on Tuesday revealed details of the Trojan Linux.Ekoms.1, which takes screen shots and records audio to acquire sensitive and personal information, mostly from Linux servers.

Malware for Linux is becoming more diverse and includes spyware programs, ransomware and Trojans designed to carry out distributed denial-of-service attacks, Researchers did not assess the severity of the threat once the malware infects computers. The disclosure also did not provide details on the source of the malware or the extent of its threat to servers or desktop computers running the open source OS.

"The malware is focused on monitoring what a human user is doing, although the majority of Linux systems are servers. Therefore, they won't be as valuable for screenshots and audio recordings to attackers," said Ben Johnson, chief security strategist at Bit9+Carbon Black.

Linux is usually a server or infrastructure component, so it is not going to be reimaged or changed as often as an individual machine, he told LinuxInsider.
"This means that even if the system does not have juicy data, it could be a very compelling hiding spot for months or years for an adversary," Johnson said.