Tag

Rootkit

All articles tagged with #rootkit

technology1 month ago•4 min saved

In-Memory Linux Rootkit Targets F5 BIG-IP APM After CVE-2025-53521 Exploit

Sophos describes a second-stage Linux rootkit that targets F5 BIG-IP APM after CVE-2025-53521, hooking the Apache/PHP stack to load a memory-resident web shell, with an installer that corrupts SELinux and persists across upgrades; the malware hides strings with RC4, intercepts __libc_start_main, and creates a local UNIX socket for an interactive Bash shell, avoiding disk writes and using targeted PHP3 scripts to evade alerts, while ShadowServer notes hundreds of exposed endpoints.

via BleepingComputer|

#cve-2025-53521 #cybersecurity #f5-big-ip

technology4 months ago•4 min saved

Arch AUR Breach Hits 400+ Packages with Rootkit and Credential Stealer

Over 400 Arch User Repository packages were compromised after a spoofed maintainer injected malicious post-install steps that install a rogue npm package (atomic-lockfile) containing a Linux ELF with an eBPF rootkit and credential-stealing capabilities. The malware targets developer data and tokens across tools like Slack, Teams, Discord, GitHub, Vault, and SSH, and can exfiltrate data via HTTP. Researchers from IFIN and Sonatype describe two attack methods: hijacking orphaned PKGBUILD files to run npm post-install, and abusing a trusted maintainer identity to push malicious commits. Arch is removing the malicious commits and banning accounts; affected users should review indicators of compromise, rotate credentials, and consider reinstalling Arch if compromised.

via BleepingComputer|

#arch-linux #aur #infostealer

cybersecurity2 years ago•2 min saved

"Long-Term Exploitation: Windows Zero-Day Vulnerabilities by Lazarus Hackers"

Hackers backed by the North Korean government exploited a Windows zero-day vulnerability, CVE-2024-21338, for six months after Microsoft was informed of it, allowing them to install a stealthy rootkit on vulnerable computers. The vulnerability provided an easy and stealthy means for malware with administrative system rights to interact with the Windows kernel. Microsoft's delay in patching the vulnerability was attributed to its policy regarding admin-to-kernel vulnerabilities not representing a security boundary. The North Korean threat group Lazarus used the vulnerability to install a custom rootkit, taking advantage of the opportunity for stealth and advanced access to the Windows kernel.

via Ars Technica|

#cybersecurity #lazarus #microsoft