New BIFROSE Linux Malware Variant Using Deceptive VMware Domain for Evasion

Palo Alto Unit 42 researchers identified a new Linux variant of the long-running Bifrost RAT that disguises its C2 as a VMware-like domain (download.vmfare.com), uses a Taiwan public DNS resolver (168.95.1.1), and shows a spike in activity since October 2023 with 104 artifacts and an ARM build; the malware is associated with the state-linked BlackTech group and is distributed via email attachments, malicious websites, and multi-stage loaders.