Skip to content

Malware

SALTWATER

According to Mandiant, SALTWATER is a module for the Barracuda SMTP daemon (bsmtpd) that has backdoor functionality.

SALTWATER is a Linux malware family.

Background

Mandiant identifies SALTWATER as a backdoor-capable module for the Barracuda SMTP daemon (bsmtpd). It can transfer arbitrary files in either direction, run commands, and act as a proxy and tunnel. The backdoor works by hooking the send, recv, and close syscalls through the third-party kubo/funchook library, and is composed of five components that the binary largely labels as "Channels." Beyond their backdoor and proxying roles, these components display the usual backdoor behaviors.


Source: Malpedia (Fraunhofer FKIE).