FlipSwitch: a Novel Syscall Hooking Technique

FlipSwitch introduces a new syscall hooking technique for Linux kernel 6.9+, bypassing traditional methods rendered obsolete by changes in the syscall dispatch mechanism. The technique locates the original syscall function, scans the x64_sys_call function's machine code for a specific call instruction, and modifies its offset to redirect to a malicious function. This precise method leaves minimal traces and can be fully reverted. FlipSwitch demonstrates the ongoing evolution of attack techniques in response to kernel hardening efforts, highlighting the cat-and-mouse game between attackers and defenders in cybersecurity.

• 2026 Q3 Linux SSH Server Targeted Malware Statistics ReportMalware2026-10-14
• Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026Malware2026-10-14
• Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkitCampaign2026-09-15
• CISA Warns of Exploited Gitea VulnerabilityExploitedVulnerability2026-08-26
• Detect ICMP-Ghost Implant ICMP and DNS Tunnelling C2 Traffic Using PacketSmith Yara-X & ICMP Detection ModulesAnalysis2026-08-14