Marlin

Marlin is a type of malware, or malicious software, designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, Marlin can steal personal information, disrupt operations, or even hold data hostage for ransom. It is one of several backdoors deployed by OilRig, a cyber espionage group, which was updated and began its deployment in 2021 as reported in the T3 2021 issue of the ESET Threat Report. The other backdoors employed by OilRig include DanBot, Shark, and Milan. Marlin, along with ODAgent, OilCheck, OilBooster, SC5k v2 and v3, PowerExchange, and MrPerfectionManager, utilize various cloud service providers for their Command and Control (C&C) communications. In particular, ODAgent is a C#/.NET downloader that uses the Microsoft OneDrive API for C&C communications, similar to OilRig’s Marlin backdoor. However, unlike Marlin which supports a comprehensive list of backdoor commands, ODAgent's capabilities are more limited, focusing on downloading and executing payloads and exfiltrating staged files. In addition to its role in cybersecurity threats, the term "Marlin" also refers to Marlin Equity Partners, a company unrelated to the malware. In 2020, Marlin Equity Partners acquired Heimdal Security, a leading European provider of cloud-based cybersecurity solutions. This acquisition expanded Marlin's reach, particularly during the COVID-19 pandemic, where it supported businesses worldwide with remote work security. Despite the potential benefits of such mergers and acquisitions, concerns have been raised about market consolidation potentially limiting the options available to security chiefs.