Bifrost

Bifrost is a remote access Trojan (RAT) that has been active since 2004, designed to gather sensitive information such as hostname and IP address from compromised systems. The malware has evolved over time, with notable ties to other Trojans like FakeM MSN, Elirks, and Poison Ivy, suggesting the same developer may have been involved in creating these malicious programs. Bifrost's history extends back to attacks as old as 2009, but it has continued to adapt and evolve, posing new threats to system security. In recent years, Bifrost has increasingly targeted Linux servers. A significant development was noted on March 2, 2024, when a new variant of Bifrost was found attacking Linux servers, evading detection by mimicking legitimate domains through a deceptive practice known as typosquatting. This new variant was seen to mimic a VMware domain, allowing the malware to fly under the radar. Over the past few months, there has been a worrying spike in these Bifrost Linux variants, with Palo Alto Networks detecting more than 100 instances of Bifrost samples. The threat posed by Bifrost extends beyond traditional computing platforms, with evidence suggesting that cyberattackers are aiming to expand Bifrost's attack surface to include ARM-based devices. A vulnerability impacting both Bifrost and Valhall GPU Kernel Drivers was addressed in November 2022, indicating ongoing efforts to exploit this malware's capabilities. As ARM-based devices become more common, it's expected that cybercriminals will modify their tactics to include ARM-based malware, potentially making their attacks stronger and able to reach more targets.