A sophisticated new remote access trojan named ZynorRAT has emerged as a cross-platform threat, targeting both Windows and Linux systems through an innovative Telegram-based command and control infrastructure.

First discovered in July 2025, this Go-compiled malware represents a significant evolution in remote access capabilities, combining traditional RAT functionality with modern communication channels to evade detection and maintain persistent access to compromised systems.

The malware demonstrates remarkable versatility in its attack methodology, utilizing Telegram bots as the primary communication vector between infected machines and threat actors.

This approach allows attackers to issue commands, exfiltrate data, and monitor victim systems through encrypted messaging channels that blend seamlessly with legitimate traffic.

The use of popular messaging platforms for malicious purposes reflects the evolving landscape of cyber threats, where traditional network monitoring may fail to detect suspicious communications.

ZynorRAT’s multi-platform design enables threat actors to compromise diverse computing environments, from enterprise Linux servers to Windows workstations, creating a unified attack surface across heterogeneous networks.

Sysdig researchers identified the malware during routine threat hunting exercises, noting its unique implementation patterns and cross-platform compatibility that distinguish it from existing RAT families.

The malware’s discovery timeline reveals ongoing development efforts, with multiple samples uploaded to VirusTotal showing decreasing detection rates, suggesting active evasion improvements by its creators.

Intelligence gathered from monitored Telegram channels indicates the malware is likely developed by Turkish-speaking actors, with evidence pointing to a single developer known by the handle “halil” who may be preparing the tool for commercial distribution in underground markets.

Advanced Persistence and Command Execution Mechanisms

ZynorRAT implements sophisticated persistence techniques that vary by target platform, demonstrating the developer’s understanding of system administration practices across different operating systems.

On Linux systems, the malware exploits systemd user services through a carefully crafted service definition file placed at ~/.config/systemd/user/system-audio-manager[.]service.

This approach leverages user-specific service management capabilities that often escape detection by traditional security monitoring tools.

[Unit]
Description=System Audio Core Service
After=network.target
[Service]
ExecStart=/home/user/.local/bin/audio
Restart=always
RestartSec=10
[Install]
WantedBy=default.target

The persistence mechanism automatically restarts the malware process every 10 seconds if terminated, ensuring continuous access to compromised systems.

Command execution capabilities extend beyond simple shell access, incorporating file system enumeration through /fs_list commands, process management via /proc_list and /proc_kill functions, and comprehensive system profiling through the /metrics command that gathers hostname, user information, and external IP addresses by querying api.ipify.org.

These capabilities transform infected machines into comprehensive intelligence gathering platforms, providing attackers with detailed environmental awareness necessary for lateral movement and data exfiltration operations.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post ZynorRAT Attacking Windows and Linux Systems to Gain Remote Access appeared first on Cyber Security News.

ChillyHell first surfaced on public malware repositories in early May 2025, although its developer-signed notarization dates back to 2021.

This modular backdoor has eluded detection by major antivirus vendors despite leveraging Apple’s own notarization process to appear legitimate.

By masquerading as a benign macOS applet, ChillyHell gains an initial foothold on target machines before deploying its sophisticated attack routines.

Jamf analysts noted that initial samples were delivered through compromised websites hosting what appeared to be productivity tools.

Once executed, the malware invokes a host-profiling routine that gathers detailed system information, including user directories, shell environments, and active process lists.

This reconnaissance allows the backdoor to tailor its next actions to the victim’s environment, minimizing the risk of execution errors on diverse macOS configurations.

Following this early analysis, Jamf researchers identified ChillyHell’s dual-stage persistence strategy.

In non-privileged contexts, it installs itself as a LaunchAgent, placing a plist under ~/Library/LaunchAgents/com.apple.qtop.plist and the main binary at ~/Library/com.apple.qtop/qtop.

When elevated privileges are available, it transitions to a LaunchDaemon, writing to /Library/LaunchDaemons/com.apple.qtop.plist and /usr/local/bin/qtop.

In either case, these mechanisms guarantee execution upon login or system boot, effectively transforming infected hosts into long-term assets.

In addition to launch services, ChillyHell incorporates a stealthy fallback by injecting a launch command into the user’s shell profile.

It detects the active shell—be it Zsh, Bash, or sh—then appends an invocation line to the appropriate RC file.

This ensures that even if launch services are disabled or removed, the malware reactivates during any new terminal session.

Persistence Tactics and Timestamp Manipulation

ChillyHell’s persistence routines are further bolstered by timestamp manipulation, designed to evade forensic analysis.

After creating its LaunchAgent or LaunchDaemon artifacts, the malware calls the _utime() system call to backdate creation and modification times.

If direct system calls fail due to insufficient permissions, it falls back to shell commands:-

touch -c -a -t 202101010000 /Library/LaunchDaemons/com.apple.qtop.plist
touch -c -m -t 202101010000 /usr/local/bin/qtop

This approach not only obscures the true installation date but can inadvertently manipulate APFS birth timestamps, making detection by timeline analysis tools more difficult.

By carefully selecting a date close to genuine system events, ChillyHell effectively hides its artifacts among legitimate OS updates and user-initiated changes.

Once persistence is established, ChillyHell proceeds to its main command loop, mainCycle(), after a randomized delay.

The backdoor alternates between HTTP and DNS transports, polling hardcoded C2 servers at 93.88.75.252 and 148.72.172.53 over ports 53, 80, 1001, and 8080.

Each cycle fetches new task descriptors, decodes Base64 payloads, and dynamically loads modules such as ModuleBackconnectShell for interactive reverse shells, ModuleUpdater for self-updating capabilities, and ModuleSUBF for local password brute-forcing.

By combining notarization abuse, multi-layered persistence mechanisms, and timestamp evasion, ChillyHell represents a significant advancement in macOS threats.

Cybersecurity teams should prioritize monitoring of LaunchService plists and shell RC files, as well as implement timeline analysis to detect anomalous file modification dates.

Continued collaboration between researchers and platform vendors is essential to mitigate the evolving tactics of notarized macOS malware.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post ChillyHell macOS Malware Profiles Compromised Machines and Maintain Persistence with 3 Methods appeared first on Cyber Security News.