New Bifrost malware for Linux mimics VMware domain for evasion

Unit 42 researchers report a new, stealthier Linux variant of the long-standing Bifrost RAT that uses a deceptive VMware-like C2 domain (download.vmfare.com), resolves via a Taiwan public DNS resolver, ships as stripped binaries, exfiltrates collected host data (hostname, IP, process IDs) encrypted with RC4 over TCP, and now includes ARM builds; 104 new samples were captured since October, signaling active distribution and broadened targeting.