Loading story…
Researchers detailed OrBit, a Linux malware family targeting servers and cloud infrastructure by installing a malicious shared object and hijacking the system’s dynamic linking process to gain persistence, remote access, and credential theft capabilities. Unlike threats that rely solely on LD_PRELOAD, OrBit uses two deeper persistence methods tied to the Linux loader: it alters loader configuration and patches the ld.so dynamic linker itself, allowing the malware to load broadly across processes while making detection and removal significantly harder.
The malware’s dropper prepares files and directories, marks artifacts with a hardcoded group ID, and deploys components that can help elevate a user to root. Its payload hooks functions in libc, libcap, PAM, and libpcap to hide files, processes, network connections, and malicious library mappings, while also tampering with procfs, harvesting SSH credentials, and filtering evidence from common system utilities. The combination of SSH backdoor access, broad library hooking, and manipulation of the Linux runtime loader gives OrBit unusually stealthy, system-wide control over infected hosts.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Intezer published a report analyzing OrBit, a Linux malware family targeting servers and cloud infrastructure. The report detailed OrBit’s dual persistence methods, library hooking, credential theft, stealth features, and remote-access capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the Linux rootkit **OrBit** is not a distinct malware family but a modified deployment of the open-source **Medusa** `LD_PRELOAD` rootkit published on GitHub. Active from 2022 through early 2026, OrBit achieves persistence by forcing a malicious shared library into processes through dynamic linker configuration, hooks more than 40 functions to hide its presence, and harvests credentials from **SSH** and **sudo** activity while storing stolen data in hidden paths such as `/lib/libseconf/`. Investigators identified two build lineages: **Lineage A**, which preserved the full credential-theft and stealth feature set, and **Lineage B**, a reduced variant that dropped PAM interception, packet capture, and TCP port hiding before disappearing after 2024. The malware expanded in 2025 with a `pam_sm_authenticate` hook that can alter authentication outcomes, along with a two-stage infector and dropper chain that used cron-based retrieval from external infrastructure including `cf0[.]pw`, the first observed OrBit-related component with direct outbound communications. Researchers linked separate deployments of the same codebase to at least three threat clusters, including **UNC3886**, **BLOCKADE SPIDER**, and a 2025 campaign sharing tooling and infrastructure traits with the **RHOMBUS** botnet. Detection guidance highlighted recurring Medusa artifacts such as `sshpass.txt`, `.logpam`, and `/etc/cron.hourly/0`, as well as YARA-based identification of the malware’s XOR-encoded string table across renamed variants.
Jun 29, 2026
Security researchers detailed multiple Linux malware families that rely on native persistence mechanisms and outbound command-and-control to maintain access on compromised hosts. Intezer analyzed a stripped, statically linked ELF sample it classified as **Reekoobe** through code reuse, finding strings tied to a service named `likemae` and the domain `c[.]linux-hosts[.]com`. In dynamic analysis, the malware renamed itself to `/usr/bin/likemae`, created and enabled `likemae.service` for persistence when run with elevated privileges, and repeatedly attempted DNS lookups and TCP connections to its C2 infrastructure, although the observed port returned `RST,ACK` responses and blocked further interaction. Anomali separately documented the **Linux Rabbit** and **Rabbot** malware strains in a cryptomining campaign that installed Monero miners on Linux servers and IoT devices. Linux Rabbit used Tor hidden services and gateways for C2, persisted through `rc.local` and `.bashrc`, brute-forced SSH credentials, removed competing miners, and deployed architecture-specific miners while also injecting CoinHive scripts into compromised websites; the related Rabbot variant expanded the operation with worm-like propagation, exploitation of known vulnerabilities, and payload delivery over port 80. Together, the reports show Linux threats combining persistence, remote access, propagation, and monetization techniques across servers, web hosts, and embedded devices.
Aug 15, 2026
Researchers detailed **Symbiote**, a Linux malware family built as a 64-bit ELF shared object that loads into running processes and uses extensive function hooking to evade detection. The malware intercepts multiple `libc`, PAM, and `libpcap` functions to hide files, processes, and TCP connections, while also filtering `/proc` network data to conceal selected ports and checking process names to suppress visibility of malware-related activity. BlackBerry described the threat as a nearly impossible-to-detect Linux implant because it operates parasitically inside other processes rather than as a standalone executable. Analysis of an early Symbiote sample found that it specifically targets **SSH** and **SCP** credentials by intercepting authentication and read operations. The stolen data is encrypted with **RC4**, staged locally in a disguised file, and then exfiltrated through crafted **DNS** requests to an attacker-controlled domain, giving the malware both credential-theft and covert command-and-control capabilities. The reporting highlights Symbiote as a stealth-focused Linux threat that combines rootkit-style hiding techniques with credential harvesting and DNS-based data theft.
Aug 15, 2026