Exaramel for Linux

Executive Summary

Exaramel for Linux is an encrypted Go‑based RAT that establishes persistent HTTPS backdoor connections, enabling attackers to execute remote commands, exfiltrate data, and dynamically load additional modules. Its modular and static binary design complicates detection, making it a potent tool for covert intelligence gathering on compromised Linux servers.

Exaramel for Linux is a clandestine remote‑access trojan built in Go and released as a statically linked 64‑bit ELF binary that runs on most modern distributions without additional dependencies. Once executed, the malware opens an encrypted HTTPS channel to a command-and-control (C&C) server to receive instructions, exfiltrate collected data, and download supplementary modules. It can spawn system processes, enumerate kernel objects and environment variables, copy files across the network, and establish persistence through hidden system service entries or cron jobs. First identified by ESET as part of their TeleBots family in 2018, Exaramel has been observed targeting Linux servers and embedded devices for espionage. The tool’s modular design allows attackers to extend functionality on the fly, while its native Go implementation obscures statically compiled binaries from many signature‑based detection engines. The malware can perform privileged enumeration, remote code execution, lateral movement via SSH key or SUID binaries, and exfiltrate logs and credentials over its HTTP channel. In known campaigns it has been paired with other components of the TeleBot kit to deliver a full command-and-control ecosystem capable of targeting both internal infrastructure and external assets. Threat summary

Key Capabilities

• Establishes encrypted HTTP/HTTPS command-and-control channel
• Remote shell execution and privileged command execution
• File upload/download via HTTP(S) for dynamic module loading
• Persistence through hidden systemd or cron jobs
• Exfiltrates collected data over the same C&C channel
• Enumerates system processes, files, and environment variables

ATT&CK Techniques

Recommended Actions

• Deploy host‑based intrusion detection that flags new high‑entropy ELF binaries in standard system directories
• Enforce strict outbound firewall rules to block unknown HTTPS endpoints; maintain a whitelist of approved C&C domains
• Implement file integrity monitoring for changes to /usr/bin, /sbin, and other privileged locations
• Monitor kernel audit logs for unexpected process creation or SUID executions
• Apply least privilege principles – restrict services from running under root where possible
• Regularly patch and update Linux distributions and third‑party packages to mitigate known vulnerabilities

Suggested Tags