Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
RedTail is a Linux malware that tricks servers into running hidden programs. Attackers upload fake files to vulnerable Linux servers, which then run malicious code that hides itself, kills security tools, and opens a backdoor for remote control.
- Report priority
- Medium
- Targets
- Linux
How it works
- Attackers send fake Linux executables named for RedTail deployment packages.
- The server runs these files without checking if they are safe.
- The malware then changes its own name to hide, stops security tools watching the system, and sets up a hidden network listener for remote control.
What to do
Check if your Linux servers have unexpected executables named for RedTail deployment packages (e.g., files with names like 'RedTail_*.bin' or similar). Look for unusual processes running under names like 'systemd' or 'init' that you did not start. If you see a TCP listener on a random port, use ps aux | grep -i 'systemd', ss -tulnp, and ls /tmp to check for suspicious activity.
Immediately remove any unknown executables from your servers. Update your Linux distribution to the latest security patches. Monitor logs for unusual process activity. If you suspect an infection, isolate the server and contact your IT team or a cybersecurity expert for cleanup. No official patch for RedTail is listed; rely on system updates and manual checks.
Technical details
Attackers uploaded fake RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) to a honeypot. The x86-64 version (SHA-256: 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e) hid its process name, killed monitoring tools, and opened a backdoor.
This analysis describes a RedTail Linux malware payload observed in the wild, targeting multiple processor architectures (ARM, ARM64, i686, RISC-V, and x86-64) as part of a deployment package. The x86-64 variant (SHA-256: 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e) was statically linked, UPX-packed, and dynamically evaded detection by altering its process name, terminating competing processes (including filesystem monitors), and establishing a TCP listener for further command-and-control communication. The payload was captured via a Cowrie honeypot and analyzed in an isolated Ubuntu 24.04 environment with simulated network services. No CVE or CVSS score was assigned, as this is a threat observation rather than a software vulnerability.