3 ms·
> What kind of jerk would attack Arch Linux? The answer is: Russians Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malwa
by cookiengineer 2mo ago
> What kind of jerk would attack Arch Linux?
The answer is: Russians
Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely.
Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware.
[1] https://github.com/cookiengineer/antimiasma https://github.com/cookiengineer/antimiasma
[2] https://cookie.engineer/projects/cyber-defense/antimiasma.html https://cookie.engineer/projects/cyber-defense/antimiasma.ht...
- tmtvl 2mo agoOnly ru_RU? It doesn't get disabled with, say, zh_CN, ko_KR, or anything else where the script is outside of the Basic Multilingual Plane (AKA ASCII)?
- inigyou 2mo agoThis is also very common with malware groups that want you to think they are Russian.
- cookiengineer 2mo agoThe comment length is too small to write a thorough malware analysis. That is why I linked my blogposts, the tool, and the whitepaper that I published about it. You have to read it first to come to your own conclusions. If you come to conclusions without reading either of it, there's no point in arguing with you because you made up your mind anyways, and are not interested in learning about malware reversing :)