Cybersecurity researchers have discovered a new piece of Linux malware named “sedexp,” which uses innovative techniques to evade detection and persist on infected systems. Attributed to a financially motivated threat actor, sedexp utilizes udev rules to maintain persistence by executing malicious code whenever specific device events occur. This method allows the malware to hide credit card skimmer code and other malicious activities, such as launching a reverse shell for remote access but to call the code based on a triggering event, such as a reboot.
By embedding itself within the system’s operational routines, sedexp can remain undetected while facilitating unauthorized access and data theft, particularly targeting financial information on web servers. The discovery of this malware demonstrates the increasing sophistication and adaptability of threat actors in developing new methods to compromise systems and exfiltrate sensitive data.
The discovery of sedexp underscores the importance of robust cybersecurity measures and continuous monitoring to detect and mitigate advanced threats. As attackers increasingly employ unconventional techniques to bypass traditional security defenses, organizations must stay vigilant and employ comprehensive security strategies to protect their systems and data from such evolving threats.