Curing

Curing is a public proof-of-concept Linux rootkit developed by ARMO in April 2025 to demonstrate how malware can evade syscall-centric endpoint monitoring by abusing io_uring, the Linux asynchronous I/O interface. Written in Go and C, it performs malicious activity through io_uring operations rather than conventional per-operation system calls, creating a visibility gap for security products that rely primarily on syscall-layer telemetry or eBPF instrumentation attached only at that layer.

The rootkit was designed to show that file access, file modification, symbolic-link creation, and command-and-control communications can be carried out through io_uring while leaving little or no attack-relevant syscall trace visible to tools such as strace and some Linux EDR configurations. Reported behaviors include pulling commands from a remote command-and-control server, reading and writing local files, and conducting network communications through io_uring-backed operations. This makes it relevant as a defense-evasion case study for Linux environments running modern kernels that support io_uring.

Curing is not attributed to any threat actor and has not been confirmed as used in the wild. It is a defensive research demonstration intended to expose detection blind spots in Linux observability and endpoint security tooling. Testing associated with the proof of concept showed that some products and configurations could miss sensitive file reads, malicious payload staging, and suspicious outbound communications when those actions were mediated through io_uring, while approaches using kernel enforcement-path visibility such as LSM or KRSI-based monitoring were presented as more resilient. The project illustrates an emerging Linux stealth technique with potential for weaponization because the underlying mechanism is broadly available in contemporary Linux systems.