PamDOORa: PAM‑Based Linux Backdoor Sold on Rehub for $1,600

Cybersecurity researchers have uncovered a new Linux backdoor called PamDOORa that is being advertised on the Rehub Russian cybercrime forum for $1,600. The backdoor is a pluggable authentication module (PAM) that functions as a post‑exploitation toolkit, enabling persistent SSH access to compromised hosts. Attackers can gain access by supplying a magic password and connecting to a specific TCP port, after which the module grants root privileges. The threat actor behind the offering, known as “darkworm,” claims that the backdoor can be installed on any Linux system with PAM support. The module is designed to evade detection by standard security tools and can be loaded into the kernel at runtime.

The researchers noted that PamDOORa can be used to maintain long‑term footholds on victim machines, allowing attackers to move laterally and exfiltrate data. The backdoor’s simplicity and low cost make it attractive to opportunistic threat actors. Security teams should monitor for unusual PAM module loads and block unauthorized SSH connections that use the magic password pattern. The discovery underscores the need for strict control over PAM configuration and runtime module loading. Administrators are advised to audit their PAM settings and remove any unapproved modules.