Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware campaign using eBPF rootkit techniques; the article highlights an embedded rootkit component that protects hidden processes by hooking sys_enter_ptrace and killing debuggers or tracing tools that attempt PTRACE_ATTACH or PTRACE_SEIZE against protected PIDs.
A supply chain campaign targeting the Arch User Repository (AUR) in which attackers hijacked orphaned legitimate packages and inserted malicious post-install behavior that pulled malicious dependencies. Those dependencies acted as loaders for a Rust-based infostealer and an eBPF-based rootkit on affected Linux systems.
A Rust-based credential stealer delivered through hijacked Arch Linux AUR packages. It targets developer workstations and build systems, stealing browser/Electron session data, GitHub/npm/Vault/OpenAI credentials, SSH keys, shell history, container credentials, and VPN configs. When already running with root privileges, it can load an eBPF rootkit for stealth and persistence via systemd services.
A large-scale Arch User Repository supply-chain campaign in which orphaned AUR packages were adopted and modified to fetch malicious npm packages that executed a Linux ELF payload on developer workstations, CI/build hosts, and maintainer systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.