AI Uncovers GhostPenguin: Undetectable Linux Backdoor Used RC5-Encrypted UDP for Covert C2

According to Trend Micro, researchers have uncovered a previously unknown and undetectable Linux backdoor dubbed “GhostPenguin,” designed to provide attackers with remote shell access and file-system control over an RC5-encrypted UDP channel. The malware eschews noisy TCP in favour of a custom UDP protocol and is highly modular, with separate threads handling registration, heartbeats and data transmission.

GhostPenguin was first submitted to VirusTotal on 7 July 2025, yet remained invisible to traditional antivirus engines, with zero detections for more than four months until the AI-driven hunting system flagged it for deep analysis. The backdoor profiles victims by collecting data such as LAN IP, hostname and OS version (e.g., Ubuntu 24.04.2 LTS) and sends this information to its C2 server, repeating every second until acknowledged.

It was discovered via an AI-powered threat-hunting pipeline that analysed zero-detection Linux samples from VirusTotal. The findings underscore the need for next-generation detection that can leverage AI profiling when traditional signatures fall short.