Incident Summary

During a scheduled vulnerability and configuration scan, the i6 Security Operations Center (SOC) identified an unexpected listening service on an internal Linux application server.

The service was running on a non-standard high port and was not associated with any approved application or scheduled maintenance activity.

Initial inspection suggested the service had been created through a malicious script designed to provide persistent remote access to the system.

Because the anomaly was detected during a routine scan, the i6 team was able to investigate the activity early and remove the unauthorized backdoor before it could be actively used by the attacker.

How the Incident Started

The investigation revealed that the server had previously been accessed using a compromised user account with limited administrative privileges.

After gaining access, the attacker uploaded a small script designed to create a hidden backdoor.

The script executed a lightweight reverse shell mechanism, allowing the system to establish outbound communication with an attacker-controlled host.

This technique allowed the attacker to bypass firewall restrictions because the connection originated from inside the network.

Detection by i6 Security Monitoring

The anomaly was first detected when the i6 monitoring platform flagged an unexpected listening service during a routine system integrity scan.

Several technical indicators raised concern. A new process was listening on TCP port 49162, which was not part of the server baseline configuration. A suspicious script was identified in /tmp/.cache_update.sh, a directory commonly abused for temporary malicious files. There were outbound connection attempts to an unfamiliar external IP address, and unauthorized changes were detected in system service configurations.

These indicators prompted the i6 SOC analysts to initiate a deeper investigation.

Investigation by i6 Security Analysts

After confirming the anomaly, the i6 SOC team began a forensic analysis of the affected server.

Using system inspection tools, the analysts identified an unfamiliar process listening on a high-numbered port. Command output showed:

netstat -tulpn
tcp 0 0 0.0.0.0:49162 0.0.0.0:* LISTEN 2145/bash

The process was associated with a bash shell spawned by an unauthorized script.

Further analysis revealed a script stored in a temporary directory designed to maintain persistence. The script had created a cron job entry that periodically re-launched the backdoor process.

*/5 * * * * /tmp/.cache_update.sh

This ensured that the backdoor would restart every five minutes if it was terminated.

Network traffic analysis revealed repeated connection attempts to an external server. The suspicious host had previously appeared in threat intelligence feeds related to command-and-control infrastructure. This confirmed that the backdoor was intended to provide remote control access.

To ensure the attacker had not deployed similar mechanisms elsewhere, the i6 team initiated threat hunting across the environment. Analysts searched for similar scripts in temporary directories, unauthorized cron jobs, and suspicious outbound connections to the same external host. No additional compromised systems were identified.

Containment by i6

Once the malicious activity was confirmed, the i6 incident response team initiated containment procedures.

Actions included terminating the malicious process associated with the backdoor, removing the unauthorized script from the server, deleting the malicious cron job responsible for persistence, blocking outbound communication to the attacker-controlled IP address, and resetting credentials for the compromised user account.

These measures eliminated the attacker’s ability to reconnect to the system.

Post-Incident Security Improvements

Following the investigation, i6 worked with the organization to strengthen system monitoring and hardening practices.

Several improvements were introduced. These included implementing stricter monitoring for unauthorized service creation, enabling enhanced detection for suspicious cron job activity, improving monitoring for abnormal outbound network connections, and deploying additional integrity checks for critical servers.

These measures improved the organization’s ability to detect hidden persistence mechanisms earlier.

Conclusion

Backdoors are often deployed quietly after an initial compromise and can remain undetected for long periods if not actively monitored.

In this case, the anomaly was uncovered during a routine security scan conducted by the i6 team, preventing the attacker from maintaining long-term access to the system.

The incident highlights the importance of continuous monitoring, regular system audits, and proactive threat hunting to uncover hidden persistence mechanisms inside enterprise environments.