Turla__2020__Malware_Technical_Insight_Turla_Penquin_x64_1.pdf

Turla's Linux backdoor Penquin_x64 and its related variants are analyzed, revealing a stealth backdoor family for Linux with multiple versions, covert C2 via port knocking and libpcap-based sniffing, embedded cron impersonation, and a suite of commands for remote control; the report provides build-date estimations, MITRE ATT&CK mapping, and detection indicators to help defenders identify Penquin_x64 activity on Linux systems.