Researchers present SaMOSA, a sandbox for analyzing Linux malware that targets cyber-physical systems, featuring on-demand C2 response replay, lifecycle-bound orchestration, four synchronized side channels and multi-architecture support. A Kinsing cryptominer case study on ARM64 delivered the full C2 payload chain without live infrastructure and revealed a hidden Tor fallback and 59 new IPs.

— via arXiv Cryptography Security, Meet Udeshi, Venkata Sai Charan Putrevu, Prashanth Krishnamurthy, Ramesh Karri, Farshad Khorrami