Loading story…
A red-team loader named Dntry can execute Linux ELF payloads without writing the payload to disk or invoking execve/execveat. It temporarily stores an HTTPS-retrieved ELF in the Linux session keyring, copies it into anonymous memory, revokes the key, manually maps the ELF PT_LOAD segments, builds an x86-64 ABI-compliant stack, and transfers execution to the payload entry point.
The technique is designed to bypass filesystem and conventional process-execution telemetry, but it leaves potential detection opportunities. The transient _dntry keyring entry can be visible in /proc/keys, while deleting the loader may cause /proc/self/exe to show a (deleted) indicator. Defenders should monitor anomalous session-keyring activity, access to /proc/keys, executable anonymous memory mappings, and processes whose executable path is marked deleted.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Dntry was documented as supporting O_TMPFILE-based ELF execution, writing a payload to an anonymous inode and invoking it with execveat(AT_EMPTY_PATH), which avoids a named payload file and may appear as /tmp/#N (deleted) in telemetry. The loader also supports multiple delivery modes and process-identity spoofing through argv[0], thread-name, and command-line changes.
The Dntry red-team loader was described as storing an ELF payload temporarily in the Linux session keyring, copying it to anonymous memory, revoking the key, manually mapping ELF segments, and jumping to the payload entry point without execve or execveat. The technique can retrieve payloads over HTTPS and may leave temporary _dntry keyring entries or a “(deleted)” /proc/self/exe indicator.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcematheuzsecurity.github.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Windows malware and offensive tradecraft increasingly rely on **direct system calls**, **NTDLL unhooking**, and related userland-hook bypass methods to evade antivirus and EDR monitoring during code injection and process manipulation. Public research describes replacing high-level WinAPI calls with `Nt*` syscalls such as `NtAllocateVirtualMemory`, `NtWriteVirtualMemory`, and `NtCreateSection`, often through custom assembly stubs or frameworks like **SysWhispers**, to avoid hooks placed in `ntdll.dll`. Other documented techniques include restoring clean `.text` sections of loaded DLLs from disk, dynamically invoking APIs without standard imports, and abusing TLS-based reentrancy checks in inline hooks so security products skip behavioral inspection. These methods are reflected in real malware analyses. **WikiLoader** was observed using indirect syscalls via `ntdll.dll` to change memory protections, inject code into `bingmaps.dll`, and later inject shellcode into `explorer.exe` with `ZwOpenProcess`, `ZwAllocateVirtualMemory`, and `ZwWriteVirtualMemory`. An **XWorm** loader used direct `Nt*` syscalls for section-based payload injection into legitimate processes while checking for JMP opcodes on `Nt` functions as an anti-hooking measure. A separate **APT29-linked Dropbox loader** resolved direct syscalls through hashed lookups and restored DLL code sections from disk to remove user-mode hooks before maintaining persistence and exchanging encrypted payloads through Dropbox-based command and control.
Aug 15, 2026
A typosquatted PyPI package, **sympy-dev**, impersonated the SymPy mathematics library and delivered a staged Linux payload through backdoored polynomial-code paths. Versions `1.2.3` through `1.2.6` fetched remote JSON configuration and ELF binaries from `63.250.56.54` and `185.167.99.46`, then used `memfd_create` and `/proc/self/fd/<fd>` to execute payloads from memory without a conventional on-disk executable. Recovered second-stage payloads were UPX-packed XMRig miners communicating over Stratum TLS, though the loader could run arbitrary code with the Python process's privileges. The campaign illustrates a broader Linux evasion pattern in which attackers execute ELF binaries, scripts, or kernel modules through anonymous memory-backed descriptors, deleted files, or unnamed temporary files. Related techniques include combining `O_TMPFILE` with `execveat(AT_EMPTY_PATH)` to run an ELF from an unnamed file. Defenders should prioritize behavioral telemetry and correlations—including `memfd_create`, execution through `/proc/self/fd`, interpreter process lineage, self-deletion, and `init_module` or `finit_module` calls—rather than relying solely on filesystem artifacts; Elastic Defend 9.4.0 adds relevant telemetry on supported Linux kernels.
Sep 9, 2026
Researchers detailed **Syslogk**, a Linux loadable-kernel-module rootkit that alters kernel execution paths to conceal malware. It inline-hooks `proc_root_readdir` to hide processes associated with `was_sys_relay`, `tcp4_seq_show` to remove selected listening ports from TCP socket listings, and VFS `readdir` operations to conceal files and directories containing `was-patch`. Syslogk also unlinks itself from kernel-module and sysfs listings, frustrating checks using `lsmod` and `/sys/module`; kernel-level investigation and remediation are required to restore visibility. The activity reflects a broader Linux rootkit tradecraft pattern spanning user-space dynamic-linker hijacking through `LD_PRELOAD`, malicious kernel modules, ftrace and syscall hooks, and newer eBPF or `io_uring`-assisted techniques. Recent malware including PUMAKIT has combined memory-resident execution, an LKM rootkit, and an `LD_PRELOAD` shared object for persistence, stealth, privilege escalation, and command execution. Defenders should monitor sensitive linker and SSH configuration changes, suspicious shared objects and kernel modules, loaded eBPF programs, kernel-function and VFS-pointer integrity, tracing/probe activity, and anomalous web-server or system-account behavior.
Sep 9, 2026