Malware
PeerTime
According to Cisco Talos, PeerTime is an ELF-based backdoor compiled for multiple architectures including common embedded and server platforms, with one version written in C/C++ and a newer version wr
PeerTime is a Linux malware family operated by UAT-9244.
Background
Cisco Talos describes PeerTime as an ELF backdoor built for several architectures spanning typical embedded and server platforms, with one variant coded in C/C++ and a more recent one in Rust. It arrives through shell scripts plus a supporting "instrumentor" component that can recognize container runtimes and start the loader within them; that instrumentor holds Simplified Chinese debug strings suggesting Chinese-speaking authors. The loader decrypts and decompresses the primary payload in memory, can relabel its process to look legitimate, and leverages the BitTorrent protocol to locate command-and-control details, swap data with peers, and fetch and run further payloads. PeerTime relies on ordinary Unix tools to copy and position downloaded files, allowing adaptable post-compromise tooling across a wide range of Linux and embedded devices.
Source: Malpedia (Fraunhofer FKIE).