A Look Into Fysbis: Sofacy’s Linux Backdoor - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 analyzes Fysbis, a modular Linux trojan/backdoor attributed to the Sofacy (APT28/Sednit) group, detailing three ELF samples (32- and 64-bit), their installation behaviors (root and non-root persistence paths), a rolling double-XOR decoding routine for install paths and C2 configuration, and associated infrastructure such as azureon-line.com, mozilla-plugins.com and IPs (e.g., 198.105.125.74, 104.207.130.126). The report provides IoCs (MD5/SHA256/ssdeep hashes, file paths, domains, and IPs), discusses implications for Linux security and detection challenges, and notes existing protections/signatures in Palo Alto Networks products.