AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows

This report documents the discovery and deep technical analysis of GhostPenguin, a multi-threaded Linux backdoor found via an AI-augmented hunting pipeline; it describes the sample’s capabilities (remote shell, full filesystem manipulation, reliable UDP C2 over port 53 using a session-derived RC5 key), packet formats, supported commands, persistence/instance-check behavior, and provided IOCs and hunting queries to detect the threat.