RFRx003

Security researchers at RT-Solar have published an analysis of RFRx003, a custom Linux backdoor used in a 2026 attack on an IT company. The malware enabled attackers to maintain long-term persistence, move laterally across networks, and quietly exfiltrate data. Commenters in the cybersecurity community are sharing the write-up for its technical detail on stealth techniques.