Loading malware…
RingReaper is a Linux-focused post-exploitation agent that abuses the kernel io_uring interface to reduce the syscall-centric telemetry relied on by many endpoint monitoring and detection products. By submitting operations through io_uring rather than repeatedly invoking conventional system calls, it can perform activity with fewer observable monitoring events, making operator actions harder to detect in environments that depend heavily on audit, hook-based, or eBPF-driven visibility. It is not inherently invisible, but it is designed to lower visibility and complicate detection.
RingReaper functions as a command-and-control capable implant for compromised Linux hosts. Reported capabilities include executing commands, maintaining interactive sessions, enumerating users and sessions, transferring files to and from the target, and searching for privilege-escalation opportunities such as useful SUID binaries. It has also been described as collecting host and user information and performing general post-compromise reconnaissance.
A notable feature is its anti-monitoring functionality aimed at eBPF-based security tooling. Its killbpf capability attempts to disrupt pinned eBPF programs and maps and terminate processes interacting with those maps, potentially degrading the visibility of Linux security products that depend on eBPF for kernel telemetry. This places RingReaper within the broader trend of modern Linux stealth tooling that leverages newer kernel mechanisms such as eBPF and io_uring to evade traditional monitoring models.
RingReaper has been discussed as an example of emerging Linux rootkit-adjacent or defense-evasion tradecraft, but the strongest support is for its role as a post-exploitation implant rather than a classic kernel rootkit. Public reporting associates its development with MatheuZSecurity, while operational threat-actor attribution remains unavailable. It targets Linux systems, particularly environments where defenders rely on syscall visibility and eBPF-based telemetry for detection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux post-exploitation agent/backdoor that abuses io_uring to reduce traditional syscall-based EDR visibility. The content describes capabilities including reconnaissance, file transfer, C2 communications, command execution, session management, privilege-escalation discovery, and disruption of eBPF-based monitoring via its killbpf function.
A Linux rootkit or rootkit-like tool that abuses io_uring for stealthy post-compromise file, process, and user enumeration operations while reducing observable syscall activity.
Recently documented (2025) Linux rootkit cited as part of the modern generation of rootkits leveraging newer kernel features (e.g., eBPF/io_uring-era techniques) for stealth and evasion.
Emerging io_uring-abuse rootkit concept aimed at evading syscall-based monitoring by batching operations through io_uring_enter and reducing observable syscall telemetry.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.