QLNX: The Linux RAT Targeting Software Supply Chain Keys

Trend Micro discovered QLNX, a previously undocumented Linux RAT that combines a dual-tier rootkit, PAM backdoor, and P2P network to steal DevOps credentials and compromise the software supply chain.

Trend Micro discovered a previously undocumented Linux RAT, dubbed QLNX, in May 2026. It is designed to silently infiltrate developer and DevOps operator workstations. The objective is not classic data theft, but the acquisition of access keys to software publishing systems: npm and PyPI tokens, cloud credentials, SSH keys, and Kubernetes configurations. From these positions, an attacker can inject backdoors into public packages, compromise CI/CD pipelines, and pivot to production environments. The discovery, published on May 4, 2026, by researchers Aliakbar Zahravi and Ahmed Mohamed Ibrahim, represents one of the most complete examples of supply-chain-oriented malware ever observed on the Linux platform.

Key Takeaways

QLNX executes in fileless mode via memfd_create and execveat, deleting the original binary from disk immediately after infection
The concealment architecture is dual-tier: a userspace LD_PRELOAD rootkit intercepts readdir, stat, open, and fopen calls, while a kernel-level eBPF module hides PIDs, files, and TCP ports
A PAM backdoor with the hardcoded master password 'O$$f$QtYJK' captures cleartext credentials and stores them with XOR encryption in /var/log/.ICE-unix
The theft module targets files specific to software development: .npmrc, .pypirc, .git-credentials, .aws/credentials, .kube/config, .docker/config.json, Terraform credentials, GitHub CLI tokens, and .env files

How QLNX Vanishes from Disk and Resists Remediation

The first phase of QLNX is fileless execution. The malware copies itself into an anonymous file descriptor in RAM via memfd_create, deletes the original binary with unlink, and verifies its own condition via readlink on /proc/self/exe looking for the substrings 'memfd:' or '(deleted)'. This technique eliminates the most elementary forensic trace: the executable file on the filesystem.

Persistence is polymorphic and redundant. Trend Micro documents at least 7 mechanisms: system and user-level systemd services, crontab with @reboot directive, init.d scripts, XDG autostart .desktop files, bootstrap via LD_PRELOAD with a shared .so library, and injection into .bashrc. This overlap ensures the compromise survives partial remediation: removing one mechanism does not neutralize the others.

The malware masks its processes as kernel threads, assuming names such as kworker or ksoftirqd. This choice is not aesthetic: common monitoring tools filter or aggregate kernel threads as noise, reducing operational visibility into anomalous activity.

The Rootkit Architecture That Makes It Invisible Even to Common Tools

QLNX implements a two-level concealment architecture explicitly described by Trend Micro as a "Two-tier rootkit architecture." The first level operates in userspace via LD_PRELOAD: a shared library intercepts the readdir, stat, open, and fopen system calls, filtering entries related to the malware's files, processes, and network connections. The second level descends into the kernel via eBPF, manipulating maps that hide specific PIDs, filenames, and open TCP ports.

The combination is rare in the contemporary Linux landscape. Most commercial or open-source rootkits stop at the userspace level; the addition of eBPF provides resilience against tools that ignore LD_PRELOAD or execute direct kernel queries. Dynamic on-target compilation is another distinctive trait: QLNX embeds C source code for the LD_PRELOAD rootkit and PAM backdoor, compiling them with gcc directly on the victim machine before deployment via /etc/ld.so.preload. This contextual adaptation avoids distributing precompiled binaries that could be detected by signature.

Targeted Theft of DevOps Credentials and Pivoting to the Supply Chain

The QLNX credential harvesting module is not generic: it is designed to recognize and extract credentials from files specific to the software development ecosystem. The list documented by Trend Micro includes .npmrc for the npm registry, .pypirc for PyPI, .git-credentials for Git repositories, .aws/credentials for Amazon Web Services, .kube/config for Kubernetes clusters, .docker/config.json for container registries, .vault-token for HashiCorp Vault, Terraform files, GitHub CLI tokens, and .env configurations.

The operational objective is clear: with these credentials, an attacker can publish compromised versions of widely used software packages, inject backdoors into automated build artifacts, or move laterally from development environments to production infrastructure. The sector context provides a scale of reference: packages like Axios exceed 400 million monthly downloads, according to Hive Security. The compromise of a single maintainer's credentials with access to such widely distributed repositories amplifies the impact from a single incident to a sector-wide catastrophe.

The PAM backdoor completes the picture with a parallel access mechanism: inline hooking on the Linux authentication system with the hardcoded master password 'O$$f$QtYJK'. Intercepted credentials are stored in /var/log/.ICE-unix with XOR encryption, a path that mimics legitimate system directories and evades superficial checks.

"QLNX targets developers and DevOps credentials across the software supply chain" — Trend Micro researchers Aliakbar Zahravi and Ahmed Mohamed Ibrahim, cited by The Hacker News

The P2P Mesh Network That Complicates Eradication and Detection

QLNX integrates peer-to-peer networking capabilities with a routing table for agent-to-agent relay of command and control. This P2P mesh architecture eliminates dependence on centralized C&C servers: every compromised node can act as a relay for others, rendering IP blacklisting techniques ineffective and complicating analysis of the underlying infrastructure. The network remains operational even if individual nodes are isolated or remediated.

The RAT supports 58 distinct commands for full remote control of the compromised machine, according to The Hacker News citing Trend Micro. This granularity enables operations ranging from simple file exfiltration to real-time system manipulation, without the need for additional tools.

Immediate Actions

Verify the presence of SHA256 hash ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545 and SHA1 hash b0f2c668cbdd63a871c90592b6c93e931115872e in Linux development environments through endpoint detection systems
Monitor access to credential files by non-interactive processes, with particular attention to .npmrc, .pypirc, .git-credentials, .aws/credentials, .kube/config, .docker/config.json, GitHub CLI tokens, and .env files
Inspect multi-mechanism persistence configurations: user and system systemd services, crontab @reboot, init.d, XDG autostart, /etc/ld.so.preload, and .bashrc, looking for anomalies in binary paths and names
Use Trend Vision One for detection and blocking of specific IoCs documented in the Trend Micro report, verifying the platform is configured to detect eBPF-based concealment and process masquerading as kernel threads

Dossier Limits and Outstanding Questions

Trend Micro does not specify the initial infection vector for QLNX. It is unclear how the malware reaches the first compromised machine: phishing, a prior supply chain compromise, initial access via exposed credentials, or other techniques remain undocumented. Attribution to a specific threat actor group is equally absent: no infrastructural overlap with known campaigns is declared in the primary sources.

The scale of real-world infection is not quantified. It is unclear whether QLNX has been observed in-the-wild at scale, whether the analyzed sample represents a single observation or an active campaign. Victim geography and the period of activity prior to the May 4, 2026 discovery are not reported. The existence of specific patches or mitigations beyond IoC detection is also undocumented: the brief does not list security updates to apply to eliminate vulnerabilities exploited by the malware.

The relationship with the existing Windows RAT Quasar is not established. Despite the naming, no evidence of code relationship or malware family connection is reported in the analyzed sources.

QLNX represents a significant evolution in the threat to the software supply chain: it does not attack repositories directly, but the workstations that feed them. The combination of extreme persistence, kernel-level concealment, and targeted theft of DevOps credentials demands a rethinking of defenses, shifting focus from on-disk malware detection to behavioral monitoring of processes that touch development secrets. The question is no longer whether a development environment is compromised, but whether one can detect it before credentials end up in a package distributed to millions of installations.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references