Chinese Cyberspies Deploy New SSH Backdoor in Network Device Attacks

Evasive Panda, also known as DaggerFly, has been actively targeting network appliances since mid-November 2024 by injecting a novel malware into the SSH daemon (SSHD). This malware, designated “ELF/Sshdinjector.A!tr” by Fortinet’s FortiGuard Labs, allows attackers to hijack SSHD processes, facilitating persistent access and clandestine operations on compromised devices. Upon breaching a system, the attackers deploy a dropper component that verifies if the device is already infected and confirms it operates under root privileges. If these conditions are met, multiple binaries, including a malicious SSH library named “libssdh.so,” are installed. This library serves as the primary backdoor, enabling the attackers to execute a wide range of malicious activities. Evasive Panda has a history of sophisticated cyber-espionage campaigns, including recent supply chain attacks via ISPs in Asia and intelligence gathering from U.S. organizations. This latest development underscores the group’s evolving tactics and the ongoing threat posed by state-sponsored cyber actors.