Loading malware…
Symbiote is a Linux malware family best described as a userland-level rootkit/backdoor that operates parasitically by loading a malicious shared object into running processes via LD_PRELOAD rather than relying on a conventional standalone executable. BlackBerry researchers reported first detecting it in November 2021 and linked it to attacks targeting the financial sector in Latin America, where it was reportedly spreading. After infecting running processes, Symbiote provides rootkit functionality, remote access, and credential collection capabilities.
Its stealth model centers on user-space hooking. The malware is designed to load before other shared objects, allowing it to hijack imports from libraries used by applications. It hides its presence by hooking libc and libpcap functions, and reporting describes infections as extremely difficult to detect, including against forensic analysis techniques. Symbiote also implants a backdoor that allows operators to authenticate like a normal user using an encrypted password and then execute high-privilege commands.
A notable capability is concealment of network activity using Berkeley Packet Filter functionality. Symbiote can inject BPF bytecode into the kernel when packet capture tools are run, adding its own filtering logic first so traffic associated with the malware is omitted from capture results. Reporting also describes Symbiote as capable of kernel packet filtering and hiding malicious network traffic from packet capture tools. Later reporting noted new variants that accept IPv4 or IPv6 packets for TCP, UDP, and SCTP on non-standard ports and use UDP high-port hopping.
Across the provided content, Symbiote is repeatedly cited as an example of Linux malware abusing LD_PRELOAD-style shared object injection for persistence and concealment, and as part of a broader trend of BPF/eBPF-enabled passive backdoors and stealth implants. The infection vector was unknown in the cited reporting. High-confidence defensive notes in the source material include monitoring for anomalous DNS activity and using statically linked security tools so userland rootkits like Symbiote cannot tamper with dynamically linked defenses.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Dynamic Linker Hijacking occurs when an attacker manipulates the linking process to redirect execution flow. This can involve altering the library search order through LD_PRELOAD, modifying configuration files like /etc/ld.so.conf, or tampering with cached library mappings in /etc/ld.so.cache.
This is also known as “hooking” any executable that tries to call libc functions.
When /proc/net/tcp is passed into the malicious library’s open() function, it parses the file contents... the malware will not write the specific entry containing the remote IP address or local port... Finally, the malicious library’s open() function returns a file descriptor for the modified file, concealing the manipulation from the victim.
Symbiote uses BPF to hide malicious network traffic on infected systems... Symbiote first adds its bytecode so that it can filter the network traffic it wants to hide.
Dynamic Linker Hijacking occurs when an attacker manipulates the linking process to redirect execution flow. This can involve altering the library search order through LD_PRELOAD, modifying configuration files like /etc/ld.so.conf, or tampering with cached library mappings in /etc/ld.so.cache.
Thanks to it loading first, it can hijack imports from other library files uploaded for the application. Symbiote uses this to hide its presence on the machine by connecting the libc and libpcap functions.
the early BPFdoor installed a Berkeley Packet Filter inside the Linux kernel that inspected incoming network traffic. When a specially crafted “magic packet” containing a predefined byte sequence arrived at the correct port, the backdoor would activate and spawn a shell. Because the system never actually opened a port, tools such as netstat, ss, or nmap saw nothing unusual.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux rootkit included in the dataset used to evaluate static detection reliability under stripping and trivial modification.
An eBPF-related malware family cited as an example of malware abusing kernel-level packet filtering for stealth and persistence.
A Linux userland-level rootkit/backdoor capable of kernel packet filtering and hiding malicious network traffic from packet capture tools.
Referenced as an eBPF malware family that demonstrates abuse of kernel packet filtering for stealth persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.