Executive Summary
Analysis of the RedTail Linux malware reveals a sophisticated, multi-architecture threat targeting x86, ARM, and RISC-V systems. The malware, often deployed via shell scripts, utilizes UPX packing and extensive host profiling to identify system resources and virtualization indicators. Despite detecting virtual environments, RedTail proceeds with infection, suggesting its design for cloud and VPS environments where virtualization is standard.
The threat demonstrates advanced defense evasion by masquerading as legitimate services like 'php-fpm' or 'postgres' and actively terminating monitoring tools such as 'inotifywait' and 'strace' using SIGKILL when sufficient privileges are available. It establishes persistence through user or root crontabs using @reboot entries and attempts to manipulate host firewalls via iptables to expose dynamically selected high-port TCP listeners.
RedTail's network behavior is characterized by the use of DNS-over-TLS (TCP port 853) to contact a hardcoded list of public and anomalous resolvers, likely to encrypt its command-and-control communications. The inclusion of a 'clean.sh' script indicates the actor also attempts to remove competing miners and common security artifacts, highlighting a focus on resource dominance.