RotaJakiro

Executive Summary

RotaJakiro is a 64‑bit Linux backdoor used by APT32, featuring a plugin architecture that enables dynamic threat capabilities. It intelligently adjusts its behavior based on privilege level—running fuller operations when executed as root and limited functions under user accounts. This modular design permits continuous evolution of the attack surface while maintaining stealth across multiple Linux distributions.

RotaJakiro is a sophisticated 64‑bit Linux backdoor first identified in 2018 and attributed to the APT32 threat group. The binary leverages a plugin-based architecture that allows attackers to download or load modular components—each adding new capabilities such as persistence mechanisms, data exfiltration tools, or lateral movement utilities. Upon execution, RotaJakiro performs an automatic privilege check: if it runs under root it enables higher‑level privileges (e.g., executing system commands with full control), whereas a normal user instance restricts itself to more limited operations. Once activated, the backdoor establishes a remote command‑and‑control channel, often via standard web protocols, and listens for instructions. Its modular design lets operators inject additional functionality on the fly, masking its true scope from defensive tooling. The combination of privilege‑aware execution and modular extensibility makes RotaJakiro a formidable component in APT32’s operational repertoire, enabling command‑execution, credential harvesting, and lateral movement across compromised Linux hosts while minimizing detection risk. The public analysis of RotaJakiro indicates that it not only maintains persistence but also monitors the host for changes such as new users or updated system binaries, allowing attackers to adapt to varying permission levels. By dynamically loading plugins based on detected permissions, the malware can evade static signatures and maintain a low profile across diverse Linux distributions. Overall, RotaJakiro represents a sophisticated, modular backdoor that enhances APT32’s ability to orchestrate large‑scale campaigns against enterprise Linux environments.

Key Capabilities

• Establishes remote command‑and‑control channel over standard web protocols
• Uses plugin architecture to dynamically load new modules and extend functionality
• Performs automatic privilege checks, enabling privileged actions when running as root
• Maintains persistence on compromised hosts
• Monitors system changes (e.g., user account additions) for adaptive threat execution

ATT&CK Techniques

Recommended Actions

• Implement host intrusion detection to flag unknown outbound connections from Linux endpoints
• Maintain strict application whitelisting and integrity verification of system binaries
• Monitor file system changes, particularly modifications to user directories and system libraries
• Enable logging of privilege escalation attempts and audit sudo usage
• Block known malicious plugin endpoints using firewall or DNS filtering

Suggested Tags