The Solar 4RAYS Cyber Threat Research Center has identified a new backdoor, RFRx003, targeting Linux-based server infrastructures in Russia. The malware was discovered in 2026 during an investigation into a security breach at a domestic IT company.
The backdoor allows attackers to execute commands, manage files, and collect system data. It also establishes hidden communication tunnels for lateral movement within internal networks. The malware is designed for long-term, stealthy presence.
RFRx003 masks its activity by mimicking standard Linux time synchronization services and legitimate system utility requests. It also disables command history logging to evade detection. The toolset does not match previously known malware.
Experts suggest that a professional APT group is likely behind the attacks. The malware poses a significant threat to the majority of Russian companies utilizing Linux environments. Security teams are advised to monitor for specific indicators of compromise.
