Loading story…
Researchers detailed Symbiote, a Linux malware family built as a 64-bit ELF shared object that loads into running processes and uses extensive function hooking to evade detection. The malware intercepts multiple libc, PAM, and libpcap functions to hide files, processes, and TCP connections, while also filtering /proc network data to conceal selected ports and checking process names to suppress visibility of malware-related activity. BlackBerry described the threat as a nearly impossible-to-detect Linux implant because it operates parasitically inside other processes rather than as a standalone executable.
Analysis of an early Symbiote sample found that it specifically targets SSH and SCP credentials by intercepting authentication and read operations. The stolen data is encrypted with RC4, staged locally in a disguised file, and then exfiltrated through crafted DNS requests to an attacker-controlled domain, giving the malware both credential-theft and covert command-and-control capabilities. The reporting highlights Symbiote as a stealth-focused Linux threat that combines rootkit-style hiding techniques with credential harvesting and DNS-based data theft.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A technical report analyzed an apparent early development build of Symbiote, describing its libc, PAM, and libpcap-related hooks used to hide files, processes, and TCP connections while stealing SSH, SCP, and PAM credentials. The report also identified the sample hash, local staging file, RC4 keying, and DNS-based exfiltration domain.
A BlackBerry blog post introduced Symbiote as a new Linux malware threat that is difficult to detect. The reference anchors this disclosure to June 2022 through the source URL path.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Linux/SSHDoor.A**, a trojanized OpenSSH daemon that steals usernames and passwords from compromised Linux servers while giving attackers covert persistent access. The malware exfiltrates server and credential data over HTTP after encrypting it with an embedded **1024-bit RSA** key and Base64-encoding the result, and it can preserve access through a hardcoded password or bundled SSH key, with override options read from `/var/run/.options`. ESET linked the activity to infrastructure including **`openssh.info`** and **`linuxrepository.org`**, which at the time resolved to **`82.221.99.69`**, and a later sample shared publicly was detected by multiple antivirus engines as an SSH backdoor. The SSH backdoor was also observed alongside **Linux/Chapro.A**, a malicious Apache module used to inject iframes into web traffic, delivering a Java exploit for **`CVE-2012-1723`** and ultimately a **Zeus/Zbot** payload to Windows victims. In later research, ESET expanded the picture beyond SSHDoor, identifying **21** undocumented or underdocumented Linux malware families built from trojanized OpenSSH binaries; **18** stole credentials and **17** provided stealth backdoor access. The findings showed that OpenSSH backdoors remained an active and diverse threat on Linux servers, ranging from simple credential theft to more advanced families using encrypted HTTP, raw TCP, or DNS for command and control.
Aug 15, 2026
Cyble Research & Intelligence Labs reported a new **Linux** intrusion chain dubbed **ShadowHS** that uses a highly obfuscated, multi-stage *fileless* loader to decrypt and execute payloads entirely in memory, minimizing disk artifacts and complicating forensic recovery. The loader reconstructs payloads via techniques including high-entropy encrypted blobs, runtime dependency checks, marker/offset manipulation, credential-based **AES** decryption, and `gzip` decompression, then executes from anonymous file descriptors while hiding via process/`argv` spoofing (often masquerading as `python3`). Once established, ShadowHS deploys a weaponized variant of the open-source post-exploitation tool **hackshell**, adapted into an interactive operator-controlled framework. Reported capabilities include host and security-control fingerprinting (including discovery of defensive tools/EDR), credential theft, privilege escalation, lateral movement, and data exfiltration, with an emphasis on stealthy persistence and evasion of endpoint monitoring and network controls.
Jun 29, 2026
Researchers detailed **OrBit**, a Linux malware family targeting servers and cloud infrastructure by installing a malicious shared object and hijacking the system’s dynamic linking process to gain persistence, remote access, and credential theft capabilities. Unlike threats that rely solely on `LD_PRELOAD`, OrBit uses two deeper persistence methods tied to the Linux loader: it alters loader configuration and patches the `ld.so` dynamic linker itself, allowing the malware to load broadly across processes while making detection and removal significantly harder. The malware’s dropper prepares files and directories, marks artifacts with a hardcoded group ID, and deploys components that can help elevate a user to root. Its payload hooks functions in **libc**, **libcap**, **PAM**, and **libpcap** to hide files, processes, network connections, and malicious library mappings, while also tampering with `procfs`, harvesting SSH credentials, and filtering evidence from common system utilities. The combination of SSH backdoor access, broad library hooking, and manipulation of the Linux runtime loader gives OrBit unusually stealthy, system-wide control over infected hosts.
Aug 15, 2026