As people probably know by now, some hackers released a trojan "HiddenWasp" into the Linux world.

Article from Intezer:

So far I have not seen what the initial cause of getting infected is and how to prevent it, but I've read something about looking for a user "sftp" which is created by the trojan script, and then looking inside /etc/rc.local since it is supposed to only have "exit 0". The script appends some code to that file apparently.

There is also a hint to look for "ld.so" files that don't have string "/etc/ld.so.preload"

They mention that prevention can be done by blocking Command-and-Control IP addresses detailed on the article site.

How do i block off specific IP-addresses?

closed as unclear what you're asking by Rui F Ribeiro, muru, msp9011, X Tian, kemotep Jun 17 at 13:16

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


You would configure iptables (see your specific distro documentation) to block connections to the IP-addresses in that article, however it is likely these Command-and-Control addresses would frequently change.

There are also options such as configuring AppArmour for the specific distro you are using, or security focused desktop distros such as Qubes OS that run browsers and other programs in their own container, or other sandboxing programs such as nsjail to possibly prevent infection however since the article indicates the attack vector is not yet known it's not immediately clear the best way to defend against HiddenWasp.

Not the answer you're looking for? Browse other questions tagged or ask your own question.