Evolution of IoT Linux Malware: A MITRE ATT&CK TTP Based Approach

Abstract

In recent years, attacks against Internet of Things devices have increased by 59% says [1]. In this work, we investigate the evolution of malware that emerged in the last two years by taking advantage of the MITRE ATT&CK framework to deliver an analysis methodology based on this structure. We analyzed 14 distinct malware families that were discovered in the period by major security vendors and our threat intelligence investigations.In this paper, we propose a methodology to keep track of threats capability evolution using the MITRE ATT&CK framework. Our research aims to extend the current knowledge of Linux malware in the IoT domain and deliver a different analysis point of view. The findings presented in this paper about what changed, for example, what techniques are removed from the malware implementation, support the benefit of this analysis and tracking methodology to study the evolution of malware.