ncsc-mar-pygmy-goat.pdf

TLP CLEAR

TLP MARKING: TLP:CLEAR

Pygmy Goat

Network Device Backdoor.

Executive summary

• Uses LD_PRELOAD to get loaded into /bin/sshd and hook its accept function. • Listens on a raw socket for incoming ICMP packets to trigger a connect back, or uses the hooked accept function to search for a sequence of magic bytes in SSH connections.

• Functionality includes remote shell, packet capture, cron tasks, and creating a reverse SOCKS proxy server.

Introduction

Pygmy Goat is a native x86-32 ELF shared object that was discovered on Sophos XG firewall devices, providing backdoor access to the devic…