Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Winnti group (APT 41) ... used adore-ng ... LKM rootkits to conceal different malicious activity.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
“VFS hooking involves replacing these function pointers with rootkit-provided functions to manipulate how the filesystem presents data.” | “Rootkits are stealthy malware designed to conceal malicious activity, such as files, processes, network connections, kernel modules, or accounts.”
The malicious payload is hidden from tools like Netstat; when running, it will not appear in the list of services. For this purpose, the rootkit uses the function hk_t4_seq_show.
The demonstration hooks getdents/getdents64 so that a file named “malicious_file” is hidden from ls output. The content notes that getdents is commonly hooked by LKM rootkits.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loadable-kernel-module Linux rootkit that uses syscall and VFS hooks to conceal itself, files, and processes.
Linux loadable-kernel-module rootkit using syscall/VFS hooking to hide processes/files and conceal its own presence.
Legacy Linux LKM rootkit that manipulates VFS-related function pointers to conceal malicious activity. It was initially documented in the Winnti/APT41 toolset and later observed with RedXor.
Open-source Linux kernel rootkit mentioned as the basis for Syslogk.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.