Cybersecurity researchers have discovered a piece of Linux malware that has evaded detection through a novel persistence mechanism for at least two (2) years. The ‘sedexp’ malware has been deployed by an unknown threat actor with a likely financial motive given the malware was used to hide credit card scraping code on a web server. The malware persists in a victim Linux machine by crafting a ‘udev’ rule which effectively runs the malware on system restart. udev is a device management system that identifies devices (such as USB drives or storage drives) in the ‘/dev’ directory and allows the configuration of rules to action when there is a change in the device state. The sedexp malware adds a udev rule that effectively runs the malware (“asedexpb”) whenever the precondition is met that major and minor numbers match “/dev/random”. “/dev/random” is an essential system component on Linux which is used as a random number generator, meaning it’s highly likely this precondition will be met on restart, effectively running the malware and establishing persistence. The malware is capable of launching a remote shell to allow attacker access to the host. In addition, sedexp uses memory manipulation techniques to hide its presence on the system, making it very difficult to locate. CTIX analysts recommend that organizations review the udev rules on Linux systems to ensure they are not compromised. CTIX analysts will continue to report on new and emerging malware and associated campaigns.