Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareUsed by 1 actor

DumpItForLinux

DumpItForLinux is a Linux memory acquisition and credential-access tool observed in Palo Alto Networks Unit 42 reporting on the Chinese-linked threat cluster CL-UNK-1068. In the reported intrusions, the actor operated across both Windows and Linux environments and used DumpItForLinux together with the Volatility Framework to extract password hashes from memory. The broader campaign was described as a years-long operation affecting organizations in South, Southeast, and East Asia, including telecommunications, energy, technology, pharmaceutical, government, law enforcement, and aviation sectors, with activity assessed as strongly suggestive of espionage. DumpItForLinux was part of a credential-theft toolkit that also included Mimikatz, LsaRecorder, and the SQL Server Management Studio Password Export Tool. The provided content does not include specific indicators of compromise unique to DumpItForLinux.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
CL-UNK-1068

Other tools powering CL-UNK-1068's credential theft activities include Mimikatz, LsaRecorder, DumpItForLinux, Volatility Framework, and the SQL Server Management Studio Password Export Tool.

via scworldscworld.com
MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Credential Access

1 technique
T1003OS Credential DumpingEvidence2

"Other tools powering CL-UNK-1068's credential theft activities include Mimikatz, LsaRecorder, DumpItForLinux, Volatility Framework, and the SQL Server Management Studio Password Export Tool."

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.