New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials

# PamDOORa: New Linux Backdoor Weaponizes PAM Authentication Framework for Persistent SSH Access

A newly disclosed Linux backdoor named PamDOORa is being marketed on Russian cybercrime forums as an advanced post-exploitation toolkit capable of harvesting SSH credentials and maintaining persistent access to compromised servers. The malware, advertised by a threat actor known as "darkworm," represents a troubling evolution in attacks targeting the Pluggable Authentication Module (PAM)—a foundational security component in virtually every Linux and Unix system.

Researchers at Flare.io have detailed how PamDOORa exploits PAM's modular architecture to function as an operator-grade implant that combines credential theft, log tampering, and sophisticated anti-forensic capabilities. Although no confirmed real-world deployments have been documented, the malware's emergence highlights a critical vulnerability in one of Linux's most essential authentication systems.

## The Threat

PamDOORa is a PAM-based backdoor designed to function as a post-exploitation toolkit that provides attackers with multiple layers of persistent access and credential exfiltration. The backdoor operates by:

The tool was initially advertised on the Rehub Russian cybercrime forum on March 17, 2026, at a price of $1,600. Notably, the asking price has since dropped nearly 50% to $900 as of April 9, suggesting either insufficient buyer interest or an attempt by the threat actor to accelerate sales.

## Background and Context

### PAM: A Critical Authentication Layer

The Pluggable Authentication Module framework is a critical component in Unix and Linux security infrastructure. PAM provides system administrators with the ability to:

| Feature | Benefit |

|---------|---------|

| Modularity | Add, remove, or update authentication mechanisms without rewriting applications |

| Flexibility | Switch between authentication methods (passwords, biometrics, tokens) seamlessly |

| Privilege Management | Control which users can execute specific commands with elevated privileges |

| Policy Enforcement | Implement organization-wide authentication policies across all applications |

However, this modularity creates a critical security risk: PAM modules typically run with root privileges. A compromised, misconfigured, or malicious PAM module can introduce severe vulnerabilities, enabling credential theft and unauthorized administrative access.

### PamDOORa Is Not the First

PamDOORa is the second documented Linux backdoor targeting the PAM stack. The first, called Plague, emerged earlier and demonstrated the feasibility of PAM-based attacks. However, security researchers note that PamDOORa represents a significant evolution beyond previous implementations.

As Group-IB noted in September 2024, attackers have long understood how to manipulate PAM for malicious purposes: "The pam_exec module, which allows the execution of external commands, can be exploited by attackers to gain unauthorized access or establish persistent control by injecting malicious scripts into PAM configuration files." PamDOORa appears to have weaponized these known techniques into a sophisticated, ready-to-deploy toolkit.

## Technical Details

### How PamDOORa Works

The attack chain for PamDOORa deployment follows a predictable pattern:

1. Initial Compromise: An attacker first gains root-level access to the target Linux system through other means (exploiting a vulnerability, phishing, supply chain attack, etc.)

2. PAM Module Installation: The attacker deploys the malicious PAM module to the system's authentication stack

3. Configuration Manipulation: PAM configuration files are modified to ensure the backdoor module is loaded and executed during authentication attempts

4. Credential Harvesting: All user authentication attempts are intercepted, and credentials are captured

5. Persistence: The attacker gains persistent SSH access using the magic password/port combination

6. Log Tampering: Authentication logs are modified to remove evidence of the backdoor's activity

### Advanced Capabilities

Flare.io researcher Assaf Morag highlighted features that distinguish PamDOORa from crude proof-of-concept implementations:

"PamDOORa represents an evolution over existing open-source PAM backdoors," Morag explained. "While the individual techniques (PAM hooks, credential capture, log tampering) are well-documented, the integration into a cohesive, modular implant with anti-debugging, network-aware triggers, and a builder pipeline places it closer to operator-grade tooling than the crude proof-of-concept scripts found in most public repositories."

## Implications for Organizations

### Immediate Risk Assessment

Organizations operating Linux infrastructure face a multi-layered threat from PamDOORa:

1. Post-exploitation risk: Organizations already breached by attackers who have obtained root access are at immediate risk of PamDOORa deployment

2. Supply chain vulnerability: Managed service providers, cloud platforms, and hosting companies are particularly attractive targets, as a single PamDOORa installation can compromise hundreds of customer systems

3. Credential compromise: Once deployed, PamDOORa compromises the credentials of every user who authenticates through the infected system—including administrators, developers, and service accounts

4. Persistent access: The backdoor enables attackers to maintain long-term presence even after the initial vulnerability is patched

### Who Is Most Threatened

## Recommendations

### Immediate Actions

### Hardening Measures

| Control | Implementation |

|---------|----------------|

| File integrity monitoring | Deploy tools like AIDE or Tripwire to detect unauthorized changes to PAM binaries and configuration |

| Restrict PAM permissions | Limit file permissions on /etc/pam.d/ and PAM modules to root-only access |

| Disable unnecessary modules | Remove PAM modules that are not required for authentication |

| Enable audit logging | Configure Linux audit framework (auditd) to track PAM-related system calls |

| SSH hardening | Implement certificate-based authentication instead of password-based SSH access where possible |

| Network segmentation | Isolate critical infrastructure to prevent lateral movement if a server is compromised |

### Long-term Strategy

---

## HackWire Analysis

PamDOORa illustrates a critical inflection point in Linux attacks: as defenders patch well-known exploitation vectors, adversaries are turning inward toward the operating system's authentication framework itself. The timing is significant. While the initial discovery occurred in March 2026, the 50% price reduction by April suggests that darkworm may be testing the market or facing competitive pressure—possibly from other threat actors developing similar tools. The fact that no real-world attacks have been confirmed yet should not be reassuring; this is exactly the pattern we see with advanced tooling: it's weaponized and advertised quietly within closed communities before widespread deployment.

What makes PamDOORa particularly dangerous is that it requires only root access, not a novel zero-day exploit. Organizations already compromised by other means (ransomware groups post-exploitation, nation-state intrusions, supply chain attacks) can be silently retrofitted with persistent credential-harvesting implants—and defenders may never know because the compromise layer is so deep within the authentication stack. A defender checking for rootkits or malicious processes might miss a legitimately signed PAM module doing credential interception.

The deeper pattern: credential theft as a service is becoming modular. Just as ransomware groups buy and sell access on criminal forums, they're now buying and selling credential-harvesting tooling. This commoditization accelerates the timeline from discovery to widespread deployment. The real risk isn't that PamDOORa itself will appear in the wild tomorrow—it's that once similar tools proliferate, every post-exploitation operator will have access to cheap, reliable credential harvesting, making lateral movement and persistence faster and cheaper.

For defenders, the message is unambiguous: assume that attackers who achieve root access will harvest every credential they can. Plan your incident response accordingly. — *HackWire Editorial*

---

## Related Coverage