Linux Rootkits: Evolution, Hooking Techniques and Tradecraft
Summary
Elastic Security Labs examines Linux rootkit evolution and techniques for hiding activity, including user-space hooks, LKMs, eBPF, io_uring and kernel hooking methods, with their limitations and detection considerations.
Key points
- Linux rootkits pursue stealth and persistence through user-space methods such as LD_PRELOAD and kernel-space mechanisms including LKMs and eBPF.
- The article traces rootkit techniques from shared-object hooks and LKMs to eBPF and emerging io_uring abuse.
- It describes FlipSwitch as a way to patch a syscall call site in x64_sys_call, bypassing the effect of Linux 6.9’s changed syscall dispatch on syscall-table hooks.
- Other techniques covered include syscall-table and inline patching, VFS hooks, ftrace callbacks and kprobes, with discussion of their constraints and risks.
- Loaders may use droppers, in-memory injection or custom kernel loading; the article also discusses privilege escalation and persistence through systemd, cron or udev.
- The article says io_uring can batch operations and reduce per-operation syscall visibility, but does not itself install global hooks.
- Suggested detection approaches include memory forensics, kernel integrity checks, auditing modules and hooks, and monitoring eBPF, kprobes and io_uring activity.
Article Details
- Attack Vectors
- Malicious shared objects use LD_PRELOAD or other dynamic-linker mechanisms to intercept library calls and conceal artifacts.
- Kernel rootkits redirect execution through syscall-table changes, inline patches, VFS hooks, ftrace callbacks, or kprobes.
- eBPF programs attach to kernel events without loading a conventional kernel module; experimental io_uring techniques reduce per-operation syscall visibility.
- Rootkit loaders may download or unpack payloads, elevate privileges, clear evidence, and establish persistence.
- Defensive Notes
- Inspect kernel memory and integrity, including function prologues, syscall dispatch code, VFS pointers, and unexpected modules.
- Audit active ftrace callbacks, kprobes, and eBPF programs.
- Check for suspicious LD_PRELOAD or LD_AUDIT settings, unexpected mapped shared objects, and altered GOT entries.
- Monitor io_uring activity for unusual batching, registered resources, and metadata operations.
MITRE ATT&CK
T1014 · RootkitLinux rootkits described in the article hide files, processes, connections, and modules by intercepting user-space or kernel operations.T1053.003 · CronRootkit loaders may establish persistence through cron jobs.T1055 · Process InjectionThe article describes loaders using interfaces such as ptrace for in-memory payload injection.T1068 · Exploitation for Privilege EscalationRootkit loaders may exploit local kernel vulnerabilities such as Dirty Pipe to obtain elevated privileges.T1070.002 · Clear Linux or Mac System LogsLoaders may clear kernel, audit, or syslog entries to cover evidence of execution.T1070.003 · Clear Command HistoryLoaders may wipe bash_history to cover evidence of execution.T1105 · Ingress Tool TransferMalware droppers can download rootkit payloads after initial access.T1543.002 · Systemd ServiceRootkit loaders may install systemd units to re-execute after restart.T1546.004 · Unix Shell Configuration ModificationUserland loaders may insert preload configurations into shell profiles to execute across sessions.T1574.006 · Dynamic Linker HijackingUserland rootkits set LD_PRELOAD to load a malicious shared object that overrides libc functions.
CVE
Malware
adore-ngClassic examples of this era include Adore-ng (2004+), a syscall-hooking LKM capable of hiding itself; Diamorphine (2016), a popular hooker that remains functional on many distributions; and Reptile (2020), a modernAzazelProminent examples include the Jynx rootkit (2009), which hooked libc functions to hide files and connections, and Azazel (2013), which combined shared object injection with optional kernel-mode features.Diamorphine[Tool / technique names ] named rootkits and POCs observed – Reptile, Diamorphine (and TripleCross, Boopkit, FlipSwitch, RingReaper)JynxProminent examples include the Jynx rootkit (2009), which hooked libc functions to hide files and connections, and Azazel (2013), which combined shared object injection with optional kernel-mode features.JynxKitNotable examples include JynxKit (2012) and Azazel (2014), user-mode rootkits that hook dozens of libc functions to hide processes, files, network ports, and even enable backdoors.KnarkNotable examples of rootkits that used this technique include Diamorphine, Knark, and Reveng_rtkit.KoviDRecent rootkits such as KoviD, Singularity, and Umbra have utilized ftrace-based hooks.PUMAKITillustrating each method with examples and real-world rootkit samples (such as Reptile, Diamorphine, PUMAKIT, and, more recently, FlipSwitch) to understand how they work and how kernel evolution has challenged them.Reptile#FlipSwitch #ReptileReveng_rtkitNotable examples of rootkits that used this technique include Diamorphine, Knark, and Reveng_rtkit.SingularityRecent rootkits such as KoviD, Singularity, and Umbra have utilized ftrace-based hooks.SuckITIDT hooking is used by educational and older rootkits such as SuckIT.suterusuAnother example is Suterusu, which also applied inline patching for some of its hooks.UmbraRecent rootkits such as KoviD, Singularity, and Umbra have utilized ftrace-based hooks.
Products
Tools
Boopkit[Tool / technique names ] named rootkits and POCs observed – Reptile, Diamorphine (and TripleCross, Boopkit, FlipSwitch, RingReaper)FlipSwitch#FlipSwitch #ReptileKHOOKThe open-source rootkit Reptile extensively uses inline function patching via a custom framework called KHOOK (which we will discuss shortly).RingReaper[Tool / technique names ] named rootkits and POCs observed – Reptile, Diamorphine (and TripleCross, Boopkit, FlipSwitch, RingReaper)TripleCross[Tool / technique names ] named rootkits and POCs observed – Reptile, Diamorphine (and TripleCross, Boopkit, FlipSwitch, RingReaper)
Industries
Cloud providersReal-world Linux rootkits have been observed in attacks on cloud providers, telecoms, and governments.governmentsReal-world Linux rootkits have been observed in attacks on cloud providers, telecoms, and governments.TelecomsReal-world Linux rootkits have been observed in attacks on cloud providers, telecoms, and governments.