Loading story…
Elastic Security Labs disclosed FlipSwitch, a proof-of-concept Linux x86-64 rootkit technique that regains syscall interception on Linux kernel 6.9 and later after traditional sys_call_table overwrites ceased to control syscall dispatch. FlipSwitch identifies the compiled x64_sys_call dispatcher’s call to a target syscall, such as sys_kill, and changes the call instruction’s relative offset to redirect execution to an attacker-controlled handler. It can obtain kernel symbol addresses through kallsyms_lookup_name, potentially recovered through a kprobe, and disables the CR0 write-protect bit temporarily to modify kernel code.
The technique underscores the evolution of modern Linux rootkits beyond static signatures and conventional syscall-table hooks. Elastic released a YARA rule to identify the FlipSwitch proof of concept in memory or on disk, while its broader detection guidance recommends runtime and behavioral monitoring for kernel modules, eBPF and io_uring abuse, shared-object injection, persistence, process masquerading, and log manipulation. Organizations should collect and correlate audit, kernel, file-integrity, process, and network telemetry, and enforce module signing, kernel hardening, least privilege, mandatory access controls, and timely patching.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
ARMO research described an io_uring-based defense-evasion technique that can reduce conventional syscall visibility on Linux kernel versions 5.1 and later.
Elastic assessed ten public Linux rootkits and found that stripping symbols or appending a null byte substantially reduced VirusTotal detections for most samples, demonstrating the fragility of static signature-based detection.
Elastic Security created the Linux_Rootkit_Flipswitch_821f3c9e YARA rule to identify the FlipSwitch proof of concept in memory or on disk.
Elastic Security documented FlipSwitch, a proof-of-concept Linux x86-64 rootkit technique that patches the relative offset of a CALL instruction in x64_sys_call to redirect a selected syscall, such as sys_kill, to an attacker-controlled handler.
Linux kernel 6.9 changed x86-64 syscall dispatch to switch statement-based handling in x64_sys_call, leaving sys_call_table available for compatibility but no longer used to dispatch system calls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceelastic.co
Open sourcevirusbulletin.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Syslogk**, a Linux loadable-kernel-module rootkit that alters kernel execution paths to conceal malware. It inline-hooks `proc_root_readdir` to hide processes associated with `was_sys_relay`, `tcp4_seq_show` to remove selected listening ports from TCP socket listings, and VFS `readdir` operations to conceal files and directories containing `was-patch`. Syslogk also unlinks itself from kernel-module and sysfs listings, frustrating checks using `lsmod` and `/sys/module`; kernel-level investigation and remediation are required to restore visibility. The activity reflects a broader Linux rootkit tradecraft pattern spanning user-space dynamic-linker hijacking through `LD_PRELOAD`, malicious kernel modules, ftrace and syscall hooks, and newer eBPF or `io_uring`-assisted techniques. Recent malware including PUMAKIT has combined memory-resident execution, an LKM rootkit, and an `LD_PRELOAD` shared object for persistence, stealth, privilege escalation, and command execution. Defenders should monitor sensitive linker and SSH configuration changes, suspicious shared objects and kernel modules, loaded eBPF programs, kernel-function and VFS-pointer integrity, tracing/probe activity, and anomalous web-server or system-account behavior.
Sep 9, 2026
Linux kernel developers are reviewing an emergency runtime mitigation called **Killswitch** after public disclosure of multiple local privilege escalation flaws, including **Copy Fail** (`CVE-2026-31431`) and the chained **Dirty Frag** bugs (`CVE-2026-43284`, `CVE-2026-43500`). Dirty Frag, disclosed by researcher Hyunwoo Kim and discussed by Red Hat and other outlets, affects kernel networking paths tied to IPSec ESP and `RxRPC` and can let an unprivileged local user gain root on many distributions. Copy Fail, a separate nine-year-old flaw in `AF_ALG` cryptographic sockets, was also reported as enabling reliable local root escalation by allowing controlled writes into the kernel page cache of readable files. Government and vendor guidance warned that public proof-of-concept exploit code is available and that risk increases if the local flaws are paired with remote code execution. The Canadian Centre for Cyber Security said no universal fix was immediately available across all stable kernels and urged defenders to identify exposed systems, restrict local access, reduce privileges, regenerate `initramfs`, and disable vulnerable modules where possible. In parallel, a GitHub project circulated shell-based stopgap patching to disable or rename affected modules on running systems, while the proposed Killswitch mechanism would let administrators force selected kernel functions to return safely without executing until patched kernels can be deployed.
Jun 29, 2026
Researchers analyzed a leaked development archive attributed to a Chinese-speaking threat actor containing VoidLink Linux rootkit source code, binaries, deployment scripts, and version history. The framework pairs a loadable kernel module (LKM) for kernel-level hiding, ftrace hooks, and ICMP-based command-and-control with an eBPF component that alters Netlink response buffers to hide network connections from the `ss` utility. The code shows at least four generations of development, evolving from CentOS 7 syscall-table patching to Linux 5.x ftrace-based hooks. Later versions added delayed initialization, anti-debugging, protection against process termination, module-name obfuscation, and persistence mechanisms intended to conceal memfd-backed fileless implants. Deployment artifacts linked operational infrastructure to Alibaba Cloud IP addresses, while source annotations and iterative revisions supported prior assessments that its development involved human operators using AI assistance.
Sep 9, 2026