Thought Leadership
Security researchers have uncovered a backdoor in the open-source FirewallFalcon Manager tool that gives attackers control over network traffic.
The campaign was discovered by Assaf Morag, a security researcher at Flare, after one of the company’s own honeypot servers was compromised and abused to deploy FirewallFalcon. The tool is actively promoted in relevant Telegram groups as a free, open-source solution for managing VPN, proxy, and SSH tunneling infrastructure. Its users are primarily located in the Middle East, Africa, and other emerging markets, where it is often used to resell SSH tunnels or bypass mobile data limits. The publicly accessible code manages a range of real, legitimate services, including Nginx, HAProxy, V2Ray/XRay, DNS tunneling, SSL certificates, and Linux user accounts.
The actual attack targets the DT Tunnel component, a legitimate Brazilian VPN tunneling service. Under normal circumstances, its software verifies the validity of a customer subscription by sending a request to the server proxy.dtunnel.com.br. FirewallFalcon hijacks this verification process and silently redirects the requests to an attacker controlled server instead. To avoid detection, the malware also installs a fake security certificate and modifies the local hosts file, causing the affected system to incorrectly treat the attacker’s server as trusted. Together, these techniques give attackers a classic man in the middle position between users and the legitimate DTunnel servers.
Older Linux Versions Came With a Hardcoded SSH Account
According to Flare, earlier versions of the tool went even further. Installation programs obfuscated with the SHC tool used additional hidden scripts to collect server information and send it via Telegram. Some variants also created a hardcoded, privileged SSH account with known credentials, allowing the operator to regain access to compromised systems at any time.
The researchers also found a shared DNS API token embedded directly in the project. Analyzing the token made it possible to identify hundreds of associated server addresses and recurring subdomain patterns. This suggests that FirewallFalcon was apparently being used to coordinate a larger, distributed network of tunneling and proxy systems rather than serving merely as standalone management software.
Flare identified more than 650 active servers connected to the infrastructure, along with two Telegram groups with a combined membership of several thousand users where the tool is promoted. In the researchers’ assessment, the case demonstrates that software supply chain attacks are no longer limited to established open-source projects. They are increasingly moving into underground and gray markets, where operators often install tools with extensive root privileges without performing any code review or even basic security checks.
(Editorial Team)
