MalwareUsed by 1 actor

Suterusu

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT41

Winnti group (APT 41) ... used adore-ng and suterusu LKM rootkits to conceal different malicious activity.

via wiz blogwiz.io

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1547.006Kernel Modules and ExtensionsEvidence1

“Once threat actors are able to insert a malicious LKM, they have complete control over the kernel space” and “kernel module rootkits require access to the system kernel on the host machine.”

T1556Modify Authentication ProcessEvidence1

To compile the command binary: Root shell

Privilege Escalation

1 technique

T1547.006Kernel Modules and ExtensionsEvidence1

“Once threat actors are able to insert a malicious LKM, they have complete control over the kernel space” and “kernel module rootkits require access to the system kernel on the host machine.”

Stealth

4 techniques

T1014RootkitEvidence4

“The rootkit writes a jump instruction at the start (prologue) of a kernel function, which diverts execution to the rootkit’s own code.”

T1070Indicator RemovalEvidence1

Hide PID Unhide PID Hide TCPv4 port Unhide TCPv4 port Hide TCPv6 port Unhide TCPv6 port Hide UDPv4 port Unhide UDPv4 port Hide UDPv6 port Unhide UDPv6 port Hide file/directory Unhide file/directory Hide network PROMISC flag Unhide network PROMISC flag

T1564Hide ArtifactsEvidence1

T1564.001Hidden Files and DirectoriesEvidence1

The demonstration hooks getdents/getdents64 so that a file named “malicious_file” is hidden from ls output. The content notes that getdents is commonly hooked by LKM rootkits.

Defense Impairment

2 techniques

T1222File and Directory Permissions ModificationEvidence1

At the moment, file/dir hiding only hides names on the / filesystem. Note that names are hidden, not paths. For instance, giving the name ".blah" to Suterusu will hide the name ".blah" in all directories on the filesystem.

T1556Modify Authentication ProcessEvidence1

To compile the command binary: Root shell

Credential Access

1 technique

T1556Modify Authentication ProcessEvidence1

To compile the command binary: Root shell

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

elastic security labsNews

Mar 5, 2026

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft

Linux rootkit cited as using inline kernel-function patching for hooks.

elastic security labsNews

Mar 1, 2026

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft - Elastic Security Labs

Linux kernel rootkit referenced as using inline function/prologue patching for hooking.

intezer blogNews

Jan 1, 2026

Linux Backdoor RedXOR Likely Operated by Chinese Nation-State

Open-source rootkit mentioned only as background on Winnti tradecraft.

wiz blogNews

Oct 24, 2023

Linux rootkits explained - Part 2: Loadable kernel modules | Wiz Blog

Linux LKM rootkit that leverages VFS manipulation to conceal malicious activity.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Suterusu

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT41

Winnti group (APT 41) ... used adore-ng and suterusu LKM rootkits to conceal different malicious activity.

via wiz blogwiz.io

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1547.006Kernel Modules and ExtensionsEvidence1

“Once threat actors are able to insert a malicious LKM, they have complete control over the kernel space” and “kernel module rootkits require access to the system kernel on the host machine.”

T1556Modify Authentication ProcessEvidence1

To compile the command binary: Root shell

Privilege Escalation

1 technique

T1547.006Kernel Modules and ExtensionsEvidence1

“Once threat actors are able to insert a malicious LKM, they have complete control over the kernel space” and “kernel module rootkits require access to the system kernel on the host machine.”

Stealth

4 techniques

T1014RootkitEvidence4

“The rootkit writes a jump instruction at the start (prologue) of a kernel function, which diverts execution to the rootkit’s own code.”

T1070Indicator RemovalEvidence1

T1564Hide ArtifactsEvidence1

T1564.001Hidden Files and DirectoriesEvidence1

The demonstration hooks getdents/getdents64 so that a file named “malicious_file” is hidden from ls output. The content notes that getdents is commonly hooked by LKM rootkits.

Defense Impairment

2 techniques

T1222File and Directory Permissions ModificationEvidence1

T1556Modify Authentication ProcessEvidence1

To compile the command binary: Root shell

Credential Access

1 technique

T1556Modify Authentication ProcessEvidence1

To compile the command binary: Root shell

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

elastic security labsNews

Mar 5, 2026

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft

Linux rootkit cited as using inline kernel-function patching for hooks.

elastic security labsNews

Mar 1, 2026

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft - Elastic Security Labs

Linux kernel rootkit referenced as using inline function/prologue patching for hooking.

intezer blogNews

Jan 1, 2026

Linux Backdoor RedXOR Likely Operated by Chinese Nation-State

Open-source rootkit mentioned only as background on Winnti tradecraft.

wiz blogNews

Oct 24, 2023

Linux rootkits explained - Part 2: Loadable kernel modules | Wiz Blog

Linux LKM rootkit that leverages VFS manipulation to conceal malicious activity.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.