CLIENTKINGClientKing

According to Symantec, ClientKing is a Rust implant used by the Jewelbug (aka REF7707, Earth Alux, CL-STA-0049) group to reach servers and network devices rather than browsers. Thirty-seven builds were observed, spanning x86-64 servers, ARM64 devices and ASUS consumer routers. It supports five command-and-control transports, including a custom DNS tunnel, and offers a full interactive shell, SOCKS pivoting and the ability to load kernel modules directly from memory. A companion toolkit adds a kernel-module rootkit and a malicious authentication module hooked into su and sudo to steal credentials.