Published on August 2, 2026
BlackTech Deploys Customized BlueShell Linux Backdoor Disguised as a Kernel Worker Process
Severity
High
Detail
Cybersecurity researchers have identified a new Linux-focused campaign in which the China-linked threat actor BlackTech deploys a customized version of the open-source BlueShell remote access trojan (RAT). The malware is designed for post-compromise operations and disguises itself as a legitimate Linux kernel worker process to evade detection and hinder forensic investigations.
Unlike the publicly available BlueShell RAT, the customized variant incorporates advanced capabilities including proxy-aware command-and-control (C2) communications, host validation, configurable runtime settings, and anti-analysis techniques. These enhancements allow attackers to maintain persistent remote access, perform lateral movement, exfiltrate sensitive data, and adapt malware behavior without recompiling the payload.
The malware is typically deployed after attackers gain initial access to targeted Linux systems through SSH-based lateral movement. A dedicated dropper unpacks the embedded BlueShell payload, injects runtime configuration, launches the malware under a forged process name resembling a legitimate kernel thread, and deletes the executable from disk to minimize forensic evidence.
How?
The attack begins after threat actors gain unauthorized access to a Linux system, typically through SSH-based lateral movement or compromised credentials. They deploy a dropper binary containing an encoded and compressed BlueShell payload, which is decoded using XOR encryption and decompressed with the FastLZ algorithm before being written to a temporary location such as `/tmp/kthread`.
Before execution, the dropper passes obfuscated runtime configuration including C2 server details, proxy settings, and host validation parameters, through an environment variable. For stealth, the malware is launched using a forged process name such as [kworker/12:12] causing it to appear as a legitimate Linux kernel worker process. Once the payload is running, the dropper deletes the temporary executable from disk, leaving minimal forensic artifacts while the malware establishes communication with its C2 server to provide persistent remote access, file transfer, SOCKS5 proxy capabilities and support for further malicious activities such as lateral movement and data exfiltration.
Recommendation
Organizations should implement the following security measures to reduce the risk of compromise:
- Restrict SSH access using strong authentication mechanisms, including SSH key authentication and multi-factor authentication (MFA).
- Monitor Linux systems for suspicious processes impersonating kernel worker threads, particularly those with deleted or anonymous executables.
- Inspect /proc/PID/exe for processes masquerading as kernel components but referencing deleted binaries.
- Detect and investigate unauthorized executables launched from temporary directories such as /tmp.
Source