Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The actor modifies the service run script, remounts /rootfs.rw executable, launches a malicious script “conf_sshd” in the background, and then starts the legitimate sshd service.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Code = 0x100: Execute command using “/bin/sh -c <command>”
Modified runit service scripts launch KeyDrift components
Modified runit service scripts launch KeyDrift components
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.