Linux Loadable Kernel Module Rootkits: How They Work and How to Detect Them
Summary
A practical guide explains how Linux kernel-module rootkits hide activity, the permissions and kernel hooks they rely on, examples seen in the wild, and ways to detect and prevent them.
Key points
- LKM rootkits operate in kernel space and can hook system calls or kernel functions to conceal malicious activity.
- Loading a module requires root or SYS_MODULE capability; privileged containers and containers with that capability can expose the host kernel.
- The article describes syscall-table modification, Kprobes, Ftrace, and VFS manipulation as hooking methods.
- A demo module hides files beginning with “malicious_file” by hooking getdents and getdents64; the demo is limited to Linux kernel versions 4.16.0–5.7.0 on x86/x86_64.
- The article cites rootkit use by TeamTNT, Winnti-linked activity, and malware including Reptile, RedXor, Syslogk, and Skidmap.
- Suggested detection measures include comparing the runtime filesystem with an image snapshot, monitoring init_module and finit_module calls, and using tools such as unhide.
- Recommended safeguards include avoiding unnecessary privileged containers and capabilities, limiting privileges, applying AppArmor or SELinux, and using secure boot.
Article Details
- Topic
- Linux loadable kernel module (LKM) rootkits: techniques, real-world use, detection, and prevention
MITRE ATT&CK
Threat Actors
Malware
adore-ngWinnti group, (APT 41) which used adore-ng and suterusu LKM rootkits to conceal different malicious activity.DiamorphineTeamTNT, which used the Diamorphine open-source LKM rootkit to hide cryptomining process.MelofeeMelofee malware / Campaign targeting vulnerable Fortinet services / Campaign targeting South Korean companies: Reptile rootkit.RedXorWinnti group (APT 41) / RedXor malware / Syslogk malware: Adore-ng, Suterusu rootkits.ReptileAn open-source LKM rootkit project that leverages this method: Reptile (leverages khook). SkidmapSkidmap malware.suterusuWinnti group, (APT 41) which used adore-ng and suterusu LKM rootkits to conceal different malicious activity.SyslogkWinnti group (APT 41) / RedXor malware / Syslogk malware: Adore-ng, Suterusu rootkits.