Cyber criminals deploy SPECTRE backdoor with Linux rootkit and BYOVD kit

KUALA LUMPUR, 21 AUGUST 2026 —

Malaysian firms warned of advanced SPECTRE malware targeting Windows, Linux systems

In a technical report published on Wednesday, Cisco Talos Intelligence detailed how UAT-10147 has evolved its tactics, integrating AI-assisted development into its tooling to enhance operational efficiency. The group, previously documented by Talos for exploiting internet-facing IIS and Linux servers at scale, now employs a diverse arsenal including SEO fraud utilities, privilege escalation tools, and both off-the-shelf and custom backdoors.

The newly uncovered SPECTRE backdoor is a cross-platform C-based implant designed to operate on both Windows and Linux systems, with distinct variants tailored for each environment. Talos researchers named the malware based on a debug log recovered from a sample, which explicitly recorded its execution steps under the header "SPECTRE."

On Windows, SPECTRE distinguishes itself from the Havoc framework by incorporating custom post-exploitation and defense evasion capabilities directly into its binary. The implant employs dual-layered obfuscation, including runtime API resolution via PEB hash walking using a DJB2 variant algorithm, and string encryption via a per-string xorshift32 pseudorandom number generator (PRNG). Sensitive literals are encrypted at compile time with unique 32-bit seeds and decrypted only during execution, rendering static detection methods largely ineffective.

SPECTRE also features a weighted anti-analysis scoring routine that evaluates factors such as process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and sandbox hostnames/usernames. If the cumulative score reaches or exceeds 50 points, the process self-terminates to avoid analysis. The malware reads its C2 configuration from an NTFS Alternate Data Stream (ADS) located at `C:\Windows\System32\drivers\etc\hosts:cache`, allowing threat actors to update configurations without recompiling the binary.

The Windows variant of SPECTRE supports 45 commands, with 24 in plaintext and 21 encrypted using the xorshift PRNG. These commands are categorized into process injection, privilege escalation and credential theft, and BYOVD EDR killer capabilities. Injection methods include standard process hollowing (targeting `svchost.exe`), APC EarlyBird injection, and automated self-hollowing targeting `RuntimeBroker.exe` to evade EDR visibility.

For privilege escalation, SPECTRE creates a named pipe (`\.\pipe\spectre_<tid>`) and impersonates a SYSTEM token via `ImpersonateNamedPipeClient`. With elevated privileges, it extracts registry hives (HKLM\SAM, HKLM\SYSTEM, HKLM\SECURITY) to `%TEMP%` for offline NT hash extraction using tools like `secretsdump.py`.

The malware downloads vulnerable drivers from its C2 server, including RTCore64.sys (CVE-2019-16098) associated with MSI and DBUtil_2_3.sys (CVE-2021-21551) linked to Dell. These drivers are installed as transient kernel services, enabling arbitrary kernel read/write primitives. SPECTRE then uses hardcoded offset tables covering 13 Windows versions to locate and unlink EDR callbacks (e.g., `PspCreateProcessNotifyRoutine`, `PspCreateThreadNotifyRoutine`) via kernel writes.

This effectively blinds security products such as CrowdStrike Falcon, SentinelOne, and Microsoft Defender, allowing the threat actor to operate undetected.

The Linux variant of SPECTRE mirrors the Windows version in structure but is a statically-linked ELF x86-64 binary. Upon execution, it invokes an eight-factor anti-sandbox scoring engine before establishing C2 communication. If the score exceeds 50, the binary exits silently. The Linux version supports 29 commands, covering file system manipulation, system reconnaissance, agent management, and unrestricted shell execution. A notable feature is the `timestomp` command, which alters file timestamps using `utimensat()` to evade forensic analysis.

The most critical capability of the Linux variant is its integrated kernel-level rootkit, named Specter, deployed as a loadable kernel module disguised as `acpi_pad.ko` to mimic the legitimate ACPI processor power management module. Persistence is maintained via a fraudulent systemd unit file (`hardware-monitor.service`) with the description "Hardware Performance Monitor", configured to execute before `sysinit.target`, ensuring the rootkit loads prior to security tooling during system boot.

Specter leverages the Linux kernel’s `ftrace` instrumentation framework with `FTRACE_OPS_FL_IPMODIFY` to redirect execution at the entry point of six syscall handlers, further evading detection. Unlike Windows, the Linux rootkit does not patch the syscall table but instead hooks function entry points, making it harder to detect via traditional methods.

Talos assesses with medium confidence that components of this campaign are associated with "x神" ("xshen"), a threat actor previously linked to SEO fraud operations. Development artifacts embedded in the BadIIS malware and related tooling support this connection.

Additional references to "X" appear in campaign components, including a `X-seo` string in the ASHX SEO engine configuration and an `X-ID` HTTP header in the web shell, which facilitates covert authentication by blending control traffic into routine HTTP communications.

The emergence of SPECTRE marks a significant evolution in commodity intrusion tooling, combining cross-platform functionality, AI-assisted development, and kernel-level evasion techniques. For Malaysian enterprises, particularly those operating Windows and Linux servers, the threat poses a critical risk to data integrity and operational security.

Cybersecurity experts recommend immediate patching of vulnerable drivers, monitoring for ADS-based C2 configurations, and enhanced behavioral analysis to detect anomalies in process injection and kernel hooking activities. Organizations are also advised to review systemd unit files and kernel module integrity, as Specter’s persistence mechanism exploits legitimate system components to maintain long-term access.

As threat actors continue to refine their tooling with AI-assisted development, the cybersecurity landscape faces growing challenges in detecting and mitigating advanced implants like SPECTRE. The integration of BYOVD tactics and kernel-level rootkits underscores the need for proactive threat hunting, endpoint detection, and continuous monitoring to safeguard critical infrastructure.

Details on the full scope of compromises and affected entities remain not yet available. Cisco Talos has not responded to requests for further comment.

Related: Microsoft