📚 PNScan Linux Trojan Resurfaces with New Attacks Targeting Routers in India

A trojan thought to have died out resurfaced with new attacks and a new and improved version, launching new attacks on routers running Linux-based firmware located in India's cyber-space. Linux.PNScan appeared online in August 2015, when Dr.Web first reported on two variants, which were later seen attacking routers in late September of the same year. First Linux.PNScan versions targeted ARM, MIPs, or PowerPC architectures Based on analysis from Dr.Web and security researcher MalwareMustDie!, we know that Linux.PNScan is an ELF binary that targets routers running on ARM, MIPs, or PowerPC architectures. The trojan was used mainly for DDoS attacks, supporting ACK, SYN, and UDP packet floods. Additionally, PNScan included worm-like features, with the ability to spread to other routers that were also ... ...