Executive Summary
Analysis of the 1337_GTWK campaign reveals a modular Linux threat designed for high-stealth operations. The infection begins with a shell script that requires root privileges to deploy a custom Linux kernel module (LKM) and a user-space agent named `gtwk_app`. The threat demonstrates a high level of resilience by including functionality to compile its own components locally if precompiled binaries are incompatible with the target's kernel version.
The technical core of this threat is the kernel rootkit, which provides advanced evasion capabilities including the concealment of files, processes, and network connections. It implements a watchdog thread, `gtwk_runner`, which ensures the `gtwk_app` agent remains active by redownloading and restarting it if terminated. The rootkit also hardens its presence by setting immutable flags on its configuration and persistence files, and it includes a fail-safe mechanism that triggers a kernel panic if the module is unloaded without authorization.
This malware poses a significant risk to Linux-based infrastructure due to its ability to bypass firewalls and maintain persistence through systemd overrides. The presence of a UTC+7 timestamp adjustment in the debug code suggests a possible origin in the Indonesian region, though definitive attribution remains unconfirmed.