RedTail Linux Malware Evolves with Process Masquerading and Multi-Architecture Support
Researchers have analyzed a sophisticated RedTail Linux payload found on a DShield honeypot, revealing its ability to masquerade as legitimate processes and support multiple hardware architectures.
Researchers have detailed the analysis of a RedTail Linux payload discovered on a DShield honeypot, highlighting its advanced capabilities including process masquerading and support for diverse hardware architectures. The initial discovery involved an attacker uploading a collection of Linux executables targeting ARM, ARM64, i686, RISC-V, and x86-64 processors, all presented as part of a RedTail deployment package.
Instead of relying solely on static indicators, the security team extracted the x86-64 variant of the malware from the Cowrie honeypot logs and detonated it within an isolated malware analysis environment. This dynamic analysis revealed that the payload performed several malicious actions beyond simple execution. It actively changed its visible process identity, terminated other running processes, specifically killed a filesystem monitoring process, and established a listening TCP socket on the compromised system. To preserve the malware's runtime state independently of the infected guest, memory images were captured from the Proxmox hypervisor.
The analysis focused on the redtail.x86_64 executable, which was identified as a statically linked ELF binary. Further static inspection indicated that the sample had been processed with the UPX executable packer, a common technique to obfuscate malware. The associated deployment scripts were designed to inspect the host architecture and select the appropriate RedTail executable for execution.
For the controlled experiment, the malware was executed within an Ubuntu 24.04 virtual machine hosted on Proxmox, isolated on a dedicated malware-analysis network. Simulated network services were provided by an INetSim server, preventing the malware from communicating with external infrastructure. This setup allowed researchers to observe the malware's network behavior without real-world risk. Multiple monitoring mechanisms, including syscall auditing, filesystem monitoring, process and socket sampling, and network packet capture, were initiated before the malware detonation.
During dynamic analysis, particularly in a root-privileged execution run, two RedTail-backed processes were observed. Crucially, these processes did not present themselves with their actual executable name. Instead, they masqueraded as php-fpm: pool www, a common process associated with PHP FastCGI Process Manager. This camouflage was achieved using the prctl(PR_SET_NAME, "php") system call, which modifies the task name displayed in process listings.
This process masquerading is a significant evasion technique. While standard process listings might suggest legitimate PHP-FPM activity, examining the /proc/<PID>/exe symbolic link and hashing the mapped executable would reveal the true identity of the RedTail binary. This behavior was consistent across multiple experimental runs, with previous observations showing RedTail processes presenting as PostgreSQL-like processes, indicating a pattern of using common, legitimate-looking service names to blend in.
The captured memory images, both pre- and post-execution, were crucial for a deeper forensic analysis. These images, acquired from the Proxmox host, provided a comprehensive snapshot of the system's state, allowing researchers to meticulously track the malware's actions, identify the modified process names, and understand its interaction with the operating system and network services.
The multi-architecture support and sophisticated evasion techniques like process masquerading demonstrate that RedTail Linux malware is a developing threat. Its ability to adapt to different environments and hide its presence makes it a challenging target for detection and analysis, underscoring the need for continuous monitoring and advanced threat intelligence.