Loading malware…
libprocesshider is an open-source Linux user-space rootkit designed to conceal selected processes from common process-enumeration utilities, including ps, top, and lsof. It operates as a shared library loaded through the Linux dynamic linker's preload mechanism rather than as a kernel module. The library interposes the libc readdir and readdir64 functions, identifies process entries during enumeration of the Linux process filesystem, and suppresses entries whose process names match a configured filter. Nonmatching entries are returned normally. Its concealment affects utilities relying on the intercepted functions; it does not remove the underlying processes from the kernel.
System-wide deployment uses the dynamic linker's preload configuration, modification of which requires root privileges. libprocesshider serves as a concealment component installed after compromise, rather than an initial-access mechanism. TeamTNT has used it to hide Tsunami bot and XMRig mining processes in Linux and cloud-container campaigns. The Xanthe cryptomining botnet also deploys it to conceal its XMRig payload. A modified version appeared in the toolkit associated with DarkRadiation Linux ransomware. It has additionally been used by UAC-0133, assessed as a Sandworm/APT44 subcluster, in operations against Ukrainian energy, water, and heat-supply organizations. These uses demonstrate its adoption across both financially motivated and state-linked intrusions.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
libprocesshider - An open-source tool that uses the ID preloader to hide a process under Linux.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
LD_PRELOAD enables users to load shared objects into a process's address space before any other shared library and prior to execution; threat actors leverage it to overwrite existing functions used by dynamically linked programs.
Every process with this name will be excluded ... static const char* process_to_filter = "evil_script.py"; ... if(get_dir_name(dirp, dir_name, sizeof(dir_name)) && strcmp(dir_name, "/proc") == 0 && get_process_name(dir->d_name, process_name) && strcmp(process_name, process_to_filter) == 0) { continue; }
Every process with this name will be excluded ... strcmp(process_name, process_to_filter) == 0) { continue; }
Rocke downloaded a file "libprocesshider", which could hide files on the target system.
Libprocesshider is an open-source tool designed to hide specific processes from commonly used process-listing tools such as ps, top, and lsof by overwriting the readdir function. This technique enabled TeamTNT to conceal XMRig cryptomining and other malicious processes.
LD_PRELOAD enables users to load shared objects into a process's address space before any other shared library and prior to execution; threat actors leverage it to overwrite existing functions used by dynamically linked programs.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.