Unexpected /usr/sbin/zfs_update binary and high outbound traffic on Proxmox Datacenter Manager

[mario ivan romano]

Hi everyone,

I am investigating a security incident on a Proxmox Datacenter Manager server and would like to confirm whether anyone has seen something similar.

The server is running Proxmox Datacenter Manager 1.1.7.

During a forensic investigation, I found an unexpected executable:

/usr/sbin/zfs_update

File information:

- Size: 5,591,040 bytes
- ELF 64-bit x86-64
- Statically linked
- Stripped
- SHA256:
546d01c3b0384ca8e47d23096116c564fb1e975eb4973e1eb04523bf1441bfb4

Filesystem timestamps:

- Birth: 2026-07-28 09:15:01 WIB
- Modify: 2026-07-02 01:31:10 WIB
- Change: 2026-08-11 16:17:42 WIB

The binary was also observed running as:

/usr/sbin/zfs_update

with PID 576.

It is not owned by any installed Debian package:

dpkg -S /usr/sbin/zfs_update
-> NOT OWNED BY DPKG

I also found evidence that a systemd configuration had previously referenced:

ExecStartPost=/usr/sbin/zfs_update --system --address=systemd:

However, the configuration is no longer present in the active systemd configuration, so I cannot confirm whether this was an actual persistence mechanism or part of the investigation/remediation process.

The binary appears to contain functionality related to SOCKS5, HTTP proxying, HTTP/2, TLS/uTLS and ChaCha20-Poly1305 encryption.

The server also had outbound communication to:

85.217.162.42
192.121.162.193

with approximately 465.7 MB of outbound traffic observed toward 85.217.162.42.

The server was subsequently isolated from the Internet.

My questions are:

1. Is `/usr/sbin/zfs_update` a legitimate component of Proxmox VE, Proxmox Datacenter Manager, or ZFS on Debian?
2. Is there any legitimate Proxmox/ZFS component that would normally create or execute a binary with this exact name?
3. Could the `ExecStartPost=/usr/sbin/zfs_update ...` configuration be related to a legitimate Proxmox/ZFS mechanism?
4. Has anyone encountered this filename or similar behavior on a Proxmox/PDM installation?
5. Are there any known Proxmox components, plugins, or installation procedures that could explain this binary?

I am trying to determine whether this is a compromised host or a legitimate component that I have incorrectly classified as suspicious.

I can provide additional forensic information, hashes, timestamps, systemd configuration and binary analysis if needed.

Thanks.

 

[dcsapak]

I'm not aware of any such binary, but i also checked multiple of my systems (pve, pbs, pdm) and zfs_update exists on none. the file list for zfsutils-linux (which is the package for the zfs userspace binaries) also does not contain it.

i think one of two things might have happened:
* either the host was compromised and this is a backdoor (as you assumed)
* someone accidentally copied/moved another binary to this place (possible, but unlikely)

also AFAICT the ips don't belong to any of our infrastructure

Since data on PDM is mostly ephemeral anyway (except rrd history and a few other configs/things) i'd probably wipe & reinstall it, and make sure any access token that the pdm had are deactived/deleted
Also I'd check every PVE/PBS host the PDM had access to (depending on the level of privileges of the access token)

EDIT: you can also try to upload the binary to a service like virustotal for an analysis and virus/malware check