cyber.hendryadrian.com
Threat Research · reversinglabs.com

ReversingLabs Identifies 163 Samples Tied to Linux Dirty Frag Flaw

· Original article ↗

Summary

ReversingLabs says it identified 163 samples tied to Linux CVE-2026-31431, including ELF, Python and PyPI variants, with samples dating to April 29, 2026. It released YARA rules and hunting queries; Ubuntu fixes are available.

Key points

  • ReversingLabs reports 163 unique samples tied to CVE-2026-31431 as of May 8, 2026: 148 carry the CVE exploit tag, while 15 V4bel-derived samples are tracked separately.
  • The earliest sample in the corpus was first seen April 29, 2026, at least nine days before the public embargo break; sample submissions surged on May 1.
  • Observed variants include ELF binaries, Python scripts, a malicious PyPI wheel, and samples associated with Linux.Trojan.Multiverze.
  • Analysis of the V4bel reference shellcode describes calls to setgid(0), setuid(0), and setgroups(0), followed by spawning /bin/sh.
  • ReversingLabs released YARA rules for the reference shellcode, but says they do not cover Python variants and may not detect Multiverze or PyPI variants unless they contain the same shellcode.
  • The article recommends combining the rules with hunting queries for broader sample coverage and applying vendor kernel updates; Ubuntu fixes are available.

Article Details

Attack Vectors
  • CVE-2026-31431 is a Linux kernel local privilege-escalation vulnerability; observed samples use it to gain root access.
  • The observed exploit corpus includes ELF binaries, Python scripts, and a malicious PyPI wheel.
  • The V4bel reference shellcode calls setgid(0), setuid(0), and setgroups(0), then uses execve to spawn /bin/sh with TERM=xterm.
  • ReversingLabs reported adoption of the exploit in samples classified as Linux.Trojan.Multiverze.
Defensive Notes
  • Apply the relevant vendor kernel updates and reboot to load the patched kernel; Ubuntu has released fixes for CVE-2026-31431.
  • Use the ReversingLabs YARA rules to hunt for the V4bel reference shellcode and derivative compilations; the article notes they may not detect Python, PyPI, or Multiverze variants.
  • Hunt across the broader sample corpus with the exploit:CVE-2026-31431 query and the article's threat-name queries, including threatname:DirtyFrag and threatname:Linux.Trojan.Multiverze AND exploit:CVE-2026-31431.
  • Scan inbound Python packages and transitive dependencies for the malicious copyfail PyPI wheel.
  • Audit setuid and setgid binaries, monitor ELF execution from writable paths, and alert on low-privilege processes spawning children with UID 0.

Indicators of compromise

TypeIndicatorContext
SHA256133a79e9094c14c0f41378c712fd9a3f7687e5ab6f781bd5fb94774e64f4b48dSHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA2561507e6e6945bfdf652ef7ed2fe10e01245074fd54d29d8eca98f265a91c88e63SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA25626865ea1744e00664a13b1a65f2e670def8d3bb84b10533f18f2e0ac43548fe0SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA25626a75e5ef8d30ae678596fafe56e1f191d17fd9a438c463cd7dcefb765c2fb94SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256381755b623dd7a4c2b5d80aaf40d7083eea727dd1f473545539029656ca81817SHA-256 of a Linux.Trojan.DirtyFrag sample identified in the ReversingLabs corpus.
SHA2563c5ec61632d0699e048d8428461c4d65f89988a370396db2f070f63ebbf9dbaeSHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256424d306e8cba73ce83af5faf051a169d957a10213509d7132b620f427b4159bbSHA-256 of a sample classified as Linux.Exploit.CopyFail.
SHA25648c0bb0760a08a70fa6cf96c0102c968cb1bc62d319cba0a605247be1e2e4180SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA2565bd7df1c89cf9f69e6003d73a8e3b9eab9cf6025e6911f0fec0451da1673d6f0SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA25676ad71ac3cf6d50bf4038048b9832df5e9aa63b85865c02ad1dd91cb2fdaef4bSHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA2567bd2a8093d38e2694199490642e91965bdc666121070330c76ae155b6581ce75SHA-256 of the malicious PyPI wheel identified as Package.Exploit.CopyFail.
SHA256912714027c9ea12b8aac55d71ccfa4a0592e058a4d07cf578e67f4bfdab63c4aSHA-256 of a Linux.Trojan.Multiverze sample identified in the ReversingLabs corpus.
SHA256a02ea2ba8108a9b7a997faa8808cfc55bb69af54e69178fa5aa1785681cf0cedSHA-256 of a sample classified as Linux.Trojan.DirtyFrag and Linux.Exploit.DirtyFrag.
SHA256a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9SHA-256 of the earliest-observed malicious sample in the reported corpus.
SHA256affde15382361e2fb87a7d32a5260ab72cc5d2d734fd7de6d21a1c94d0f58d22SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256b090751120d4814744c24253a820a67db5c3b2957c0334cf7d52e7847d6af409SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256bd855eb0a90c8cb6618662c48cc93d3a16cf9a7e4d945b70e3be3500f60042f9SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256c60c5527e49c3bb502b672b7fffc3eb5b8c6ff9d4e30eae5d559b54d2ce03a01SHA-256 of a Python-script sample classified as Script-Python.Exploit.CVE-2026-31431.
SHA256c935a349a974ef605b5a12141934d966315c0da5fe2343750815927a39f92881SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256d401e7d1c00605749d6c617ace73ab20a762b72e41c2e1590331596e38219a61SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256d658fd3b2fe203180e6a3ef6863a5eb3cdd92cfecbaa68de5b8f550702762eabSHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.
SHA256d99c480661fde92c3c7d1790c2e1d695fd72f4b82d47adb6e10093fd096c0708SHA-256 of a Python-script sample classified as Linux.Exploit.CVE-2026-31431.
SHA256e7fb35c16fbe6285d4f36764fe5f6f81b0ff51c047f5716bbb8ae60b8318d82eSHA-256 of a malicious DirtyFrag sample identified in the ReversingLabs corpus.
SHA256ea21dbc2c11ee666cb9e2b4d2cd1e6a4776b3ea6bff6d57f80a6cf31624791e9SHA-256 of a sample in the reported malicious CVE-2026-31431 corpus.

MITRE ATT&CK

T1059.004 · Unix ShellThe shellcode uses execve to spawn /bin/sh.T1059.006 · PythonPython-script variants were observed among the CVE-2026-31431 exploit samples.T1068 · Exploitation for Privilege EscalationSamples exploit CVE-2026-31431, a Linux kernel local privilege-escalation vulnerability, to gain root access.T1195.002 · Compromise Software Supply ChainA malicious PyPI wheel, copyfail-0.1.0-py3-none-any.whl, carries the exploit code.T1548.001 · Setuid and SetgidThe reference shellcode calls setgid(0), setuid(0), and setgroups(0) to normalize root credentials.

CVE

CVE-2026-31431Linux · Linux; Red Hat · NVIDIA for RHEL 10; +95 moreReversingLabs documented 163 samples tied to CVE-2026-31431, also referred to as Dirty Frag or Copy Fail, with activity beginning before the public embargo break and continuing through May 8, 2026.

Malware

Linux.Trojan.DirtyFragGitHub reference implementation are tracked separately under Linux.Exploit.DirtyFrag and Linux.Trojan.DirtyFrag.Linux.Trojan.MultiverzeThe corpus spans ELF binaries, Python scripts, a malicious PyPI wheel, and Linux.Trojan.Multiverze adoption, and RL released YARA rules and hunting queries to detect the exploit and its variants.

Vendors

ReversingLabsReversingLabs documented 163 samples tied to CVE-2026-31431, also referred to as Dirty Frag or Copy Fail, with activity beginning before the public embargo break and continuing through May 8, 2026.Ubuntu#CVE-2026-31431 #DirtyFrag #CopyFail #Linux.Trojan.Multiverze

Products

Linux kernel[T1068] Exploitation for Privilege Escalation – The Linux kernel vulnerability is used to gain root access after exploitation (‘CVE-2026-31431 kernel vulnerability triggers root access’).Spectra Analyze[PLACEHOLDER: Disassembly from Spectra Analyze showing the setgid/setuid/setgroups/execve syscall chain at addresses 0x40007e–0x4000a3 in the reference binary.Spectra AssureFor software supply chain exposure, Spectra Assure and the free Spectra Assure Community analyze open-source package risk.Spectra Assure CommunityFor software supply chain exposure, Spectra Assure and the free Spectra Assure Community analyze open-source package risk.Spectra CoreRL’s analyst classification and Spectra Core complex binary analysis confirmed malicious classification across all 163 samples ahead of broad AV consensus.Spectra Intelligence[Exploit/hunting query strings] Spectra Intelligence queries for corpus coverage – exploit:CVE-2026-31431, threatname:DirtyFrag, and threatname:Linux.Trojan.Multiverze AND exploit:CVE-2026-31431

Tools

YARAThe corpus spans ELF binaries, Python scripts, a malicious PyPI wheel, and Linux.Trojan.Multiverze adoption, and RL released YARA rules and hunting queries to detect the exploit and its variants.

Related Articles