Updated : Revised to correct outdated details and make the guidance easier to follow.
Kobalos is a backdoor first described by ESET on February 2, 2021. It affected Linux servers and other Unix-like systems, including high-performance computing clusters. It is an older discovery, rather than evidence of a newly identified outbreak.
What does Kobalos do?
ESET found a backdoor that could access files, run commands and relay connections. Its research covered Linux, FreeBSD and Solaris.
Two parts of the findings are easy to mix up:
| Component | What ESET found |
|---|---|
| Kobalos backdoor | Often hidden inside a modified SSH server program, although separate executable versions also existed. |
| Password-stealing SSH client | A separate, changed copy of the SSH client found on many compromised systems. It recorded credentials used for outgoing connections. |
That distinction matters: SSH encryption does not protect a password from a program that steals it on the computer where it is typed. This does not mean that normal, trusted copies of OpenSSH contain Kobalos.
How did it get onto the servers?
The report did not identify a single entry method or a universal OpenSSH vulnerability behind the infections. It does not show how common Kobalos is today.
For a broader explanation of legitimate remote logins, see how the SSH protocol works.
What should a server administrator check?
- Check the original indicators. Compare your findings with the hashes, technical details and detection resources linked in ESET’s Kobalos research. An unfamiliar process alone is not a diagnosis.
- Check both ends of SSH. Review the server and any client used to connect to other machines. Use trusted package records or known-good installation media to check changed binaries.
- Review access. Look for unexpected accounts, authorized keys, logins and onward connections. Keep relevant logs before making major changes.
- Keep systems supported and patched. Restrict remote access to people and networks that need it. Follow your operating system’s SSH hardening guidance.
OpenSSH supports several authentication methods and combinations, described in the official server configuration manual. Stronger authentication can reduce some password-based attacks, but it cannot make an already compromised computer trustworthy.
What if you suspect an infection?
Stop using the suspect machine to log into other systems. Follow your organization’s incident response process, isolate it where appropriate and ask the administrator or security team to investigate. A production server may need evidence preserved before a rebuild.
Change exposed credentials from a clean device and review other systems reached from that host. Simply changing a password on the infected machine can expose the replacement password too. Do not assume that deleting one file removes all attacker access.
If the suspicious activity began with an email, our guide to reading Gmail and Outlook message headers explains what those records can and cannot show. Email headers alone cannot prove a Kobalos infection.