APT41__2021__Linux_Backdoor_RedXOR_Likely_Operated_by_Chinese_Nation-State.pdf

Executive summary: Intezer discovered and analyzed RedXOR, a sophisticated Linux backdoor (masquerading as a polkit daemon) that uses an open-source LKM rootkit (adore-ng), XOR-based network encoding, a Python pty shell, persistence via init scripts, and a port-mapping tunnel; the report attributes RedXOR to Chinese nation-state actors (links to Winnti/PWNLNX), provides configuration/communication details, commands, IOCs (hashes, domains, IPs, file paths), and detection/response guidance.