<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">A random paragraph on pg 11 --</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif"><b>For the first time, BlackBerry researchers have assessed that these groups are all<br>sharing a previously unidentified Linux malware toolset referred to in this report as the<br>WINNTILNX toolset. It should be noted that these groups have also been observed<br>targeting other platforms as well, including Windows, Android, and MacOS.<br>Four of these five groups are already known to the security community as PASSCV,<br>BRONZE UNION (aka APT27, EMISSARY PANDA), a group tracked internally as CASPER<br>(aka LEAD), and the original WINNTI GROUP. But the fifth Linux splinter cell group, which<br>BlackBerry researchers are tracking as WLNXSPLINTER, is discussed for the first time<br>in this report. These threat actor groups share three important characteristics:</b></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><br></div><div><div style="font-family:tahoma,sans-serif" class="gmail_default">Seems to imply that the paper is worth at least a glance?<br></div><br></div><div>Thanks,<br><br>Ron Singh<br><br></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 8, 2020 at 7:05 PM Ron Singh <<a href="mailto:ronsingh149@gmail.com">ronsingh149@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Hey, any chapter titled, "The Linux Splinter Cell Toolset" sounds too cool to pass up reading:-) No, have't read it yet, but will.</div><div class="gmail_default" style="font-family:tahoma,sans-serif">A cursory glance at the TOC suggests that there is some meat on them bones...</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div><div dir="ltr"><div dir="ltr"><div>Thanks,<br><br>Ron Singh<br><br></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 8, 2020 at 7:01 PM jason.eckert <<a href="mailto:jason.eckert@gmail.com" target="_blank">jason.eckert@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="auto">Anything worthy of note in the PDF, or is it just trivial marketing-driven scare mongering?</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div id="gmail-m_9222584940412409361gmail-m_-6968137762982030354composer_signature" dir="auto"><div style="font-size:85%;color:rgb(87,87,87)">Sent from my Samsung device running Android (basically Linux in drag)</div></div><div dir="auto"><br></div><div><br></div><div style="font-size:100%;color:rgb(0,0,0)" dir="auto"><div>-------- Original message --------</div><div>From: Ron Singh <<a href="mailto:ronsingh149@gmail.com" target="_blank">ronsingh149@gmail.com</a>> </div><div>Date: 2020-04-08 18:42 (GMT-05:00) </div><div>To: KWLUG discussion <<a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a>> </div><div>Subject: Re: [kwlug-disc] Linux Hacked For A Decade? </div><div><br></div></div><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">I grabbed the full report(5Meg, 46-pg pdf) off their site using one of my crud email addresses, so if anyone wants it, let me know and I will send it to your email address of choice, good or crud:-)</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br clear="all"></div><div><div dir="ltr"><div dir="ltr"><div>Thanks,<br><br>Ron Singh<br><br></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 8, 2020 at 5:09 PM L.D. Paniak <<a href="mailto:ldpaniak@fourpisolutions.com" target="_blank">ldpaniak@fourpisolutions.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
Since they want my contact info to read the report (<a href="https://www.blackberry.com/us/en/forms/enterprise/decade-of-the-rats" target="_blank">https://www.blackberry.com/us/en/forms/enterprise/decade-of-the-rats</a>),
I would take any claims with a QNX of salt!<br>
<div><br>
</div>
<div><br>
</div>
<div>On 4/8/20 4:53 PM, Khalid Baheyeldin
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>Anyone saw this?</div>
<div><br>
</div>
<div>Blackberry released a report about hacking tools targeting
Linux for decades, by Chinese government linked hackers. <br>
</div>
<div><br>
</div>
<div>The articles are devoid of technical detail ... <br>
</div>
<div><br>
</div>
<div><a href="https://www.forbes.com/sites/daveywinder/2020/04/07/linux-security-chinese-state-hackers-have-compromised-holy-grail-targets-since-2012/" target="_blank">https://www.forbes.com/sites/daveywinder/2020/04/07/linux-security-chinese-state-hackers-have-compromised-holy-grail-targets-since-2012/</a></div>
<div><br>
</div>
<div><a href="https://www.thestar.com/business/2020/04/07/blackberry-uncovers-china-backed-hacking-campaign-on-linux-servers.html" target="_blank">https://www.thestar.com/business/2020/04/07/blackberry-uncovers-china-backed-hacking-campaign-on-linux-servers.html</a></div>
-- <br>
<div dir="ltr">Khalid M. Baheyeldin<br>
<a href="http://2bits.com" target="_blank">2bits.com</a>, Inc.<br>
Fast Reliable Drupal<br>
Drupal performance optimization, hosting and consulting.<br>
"Sooner or later, this combustible mixture of ignorance and
power is going to blow up in our faces." -- Dr. Carl Sagan</div>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
kwlug-disc mailing list
<a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a>
<a href="https://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" target="_blank">https://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a>
</pre>
</blockquote>
</div>
_______________________________________________<br>
kwlug-disc mailing list<br>
<a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a><br>
<a href="https://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" target="_blank">https://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a><br>
</blockquote></div>
</div>_______________________________________________<br>
kwlug-disc mailing list<br>
<a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a><br>
<a href="https://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" target="_blank">https://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a><br>
</blockquote></div>
</blockquote></div>