By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Viral Trending contentViral Trending content
  • Home
  • World News
  • Politics
  • Sports
  • Celebrity
  • Business
  • Crypto
  • Gaming News
  • Tech News
  • Travel
Reading: New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection
Notification Show More
Viral Trending contentViral Trending content
  • Home
  • Categories
    • World News
    • Politics
    • Sports
    • Celebrity
    • Business
    • Crypto
    • Tech News
    • Gaming News
    • Travel
  • Bookmarks
© 2024 All Rights reserved | Powered by Viraltrendingcontent
Viral Trending content > Blog > Tech News > New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection
Tech News

New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection

By Viral Trending Content 3 Min Read
Share
SHARE

Dec 13, 2024Ravie LakshmananLinux / Threat Analysis

Linux Rootkit PUMAKIT

Cybersecurity researchers have uncovered a new Linux rootkit called PUMAKIT that comes with capabilities to escalate privileges, hide files and directories, and conceal itself from system tools, while simultaneously evading detection.

“PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control servers,” Elastic Security Lab researchers Remco Sprooten and Ruben Groenewoud said in a technical report published Thursday.

The company’s analysis comes from artifacts uploaded to the VirusTotal malware scanning platform earlier this September.

Cybersecurity

The internals of the malware is based on a multi-stage architecture that comprises a dropper component named “cron,” two memory-resident executables (“/memfd:tgt” and “/memfd:wpn”), an LKM rootkit (“puma.ko”), and a shared object (SO) userland rootkit called Kitsune (“lib64/libs.so”).

It also uses the internal Linux function tracer (ftrace) to hook into as many as 18 different system calls and various kernel functions such as “prepare_creds,” and “commit_creds” to alter core system behaviors and accomplish its goals.

Linux Rootkit PUMAKIT

“Unique methods are used to interact with PUMA, including using the rmdir() syscall for privilege escalation and specialized commands for extracting configuration and runtime information,” the researchers said.

“Through its staged deployment, the LKM rootkit ensures it only activates when specific conditions, such as secure boot checks or kernel symbol availability, are met. These conditions are verified by scanning the Linux kernel, and all necessary files are embedded as ELF binaries within the dropper.”

The executable “/memfd:tgt” is the default Ubuntu Linux Cron binary sans any modifications, whereas “/memfd:wpn” is a loader for the rootkit assuming the conditions are satisfied. The LKM rootkit, for its part, contains an embedded SO file that’s used to interact with the rookie from userspace.

Cybersecurity

Elastic noted that every stage of the infection chain is designed to hide the malware’s presence and take advantage of memory-resident files and specific checks prior to unleashing the rootkit. PUMAKIT has not been attributed to any known threat actor or group.

“PUMAKIT is a complex and stealthy threat that uses advanced techniques like syscall hooking, memory-resident execution, and unique privilege escalation methods. Its multi-architectural design highlights the growing sophistication of malware targeting Linux systems,” the researchers concluded.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

You Might Also Like

Android 16 Security Measures: Identity Check and Advanced Protection

White House Staffers Couldn’t Care Less About the East Wing Demolition

CISA warns of Lanscope Endpoint Manager flaw exploited in attacks

North Korean Hackers Lure Defense Engineers With Fake Jobs to Steal Drone Secrets

Geotab survey reveals 90% of Irish van and lorry drivers ready to embrace in-cab AI coaching

TAGGED: Cyber Security, Cybersecurity, Elastic Security, Internet, Linux, Malware, privilege escalation, rootkit, Threat Analysis
Share This Article
Facebook Twitter Copy Link
Previous Article Macron meets centrist Bayrou ahead of imminent decision on next French PM
Next Article ZKsync targets 10K TPS and sub-zero fees by 2025 roadmap goals
Leave a comment

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

- Advertisement -
Ad image

Latest News

Is Ripple About To Overtake Ethereum? There Are More XRP Treasury Companies Than You Think
Crypto
Android 16 Security Measures: Identity Check and Advanced Protection
Tech News
Qatar and US warn EU law could threaten energy security as GECF ministers meet
Business
European Parliament rebels against simplified sustainability requirements
World News
United States and European Union Impose Sanctions on Russia
World News
Tariffs have unsettled Colorado’s ag industry; a Trump suggestion adds to uncertainty
Business
Fidelity opens the door to Solana, making SOL available to clients
Crypto

About Us

Welcome to Viraltrendingcontent, your go-to source for the latest updates on world news, politics, sports, celebrity, tech, travel, gaming, crypto news, and business news. We are dedicated to providing you with accurate, timely, and engaging content from around the globe.

Quick Links

  • Home
  • World News
  • Politics
  • Celebrity
  • Business
  • Home
  • World News
  • Politics
  • Sports
  • Celebrity
  • Business
  • Crypto
  • Gaming News
  • Tech News
  • Travel
  • Sports
  • Crypto
  • Tech News
  • Gaming News
  • Travel

Trending News

cageside seats

Unlocking the Ultimate WWE Experience: Cageside Seats News 2024

Is Ripple About To Overtake Ethereum? There Are More XRP Treasury Companies Than You Think

Investing £5 a day could help me build a second income of £329 a month!

cageside seats
Unlocking the Ultimate WWE Experience: Cageside Seats News 2024
May 22, 2024
Is Ripple About To Overtake Ethereum? There Are More XRP Treasury Companies Than You Think
October 23, 2025
Investing £5 a day could help me build a second income of £329 a month!
March 27, 2024
Brussels unveils plans for a European Degree but struggles to explain why
March 27, 2024
© 2024 All Rights reserved | Powered by Vraltrendingcontent
  • About Us
  • Contact US
  • Disclaimer
  • Privacy Policy
  • Terms of Service
Welcome Back!

Sign in to your account

Lost your password?