Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Netfilter Rootkit Samples - F. Roth - Google sheet + expansion

The threat pertains to a collection of Netfilter rootkit samples compiled and expanded by F. Roth, as documented in a Google Sheet and disseminated by CIRCL under the malware classification project. Netfilter rootkits are a class of malware that operate at the kernel level within Linux-based operating systems, leveraging the Netfilter framework, which is integral to packet filtering, network address translation (NAT), and other network-related operations. These rootkits manipulate Netfilter hooks to intercept, modify, or drop network packets stealthily, enabling attackers to conceal malicious network activities, evade detection, and maintain persistent unauthorized access. The samples collected represent various implementations of such rootkits, potentially including different evasion techniques, payloads, and persistence mechanisms. Although no specific affected versions or products are listed, the rootkits target Linux systems that utilize the Netfilter framework, which is prevalent in many server environments, network appliances, and embedded devices. The technical details indicate a high threat level and analysis confidence, but no known exploits in the wild have been reported, suggesting these samples may be used primarily for research, detection development, or as proof-of-concept malware. The lack of patch links implies that mitigation relies on detection and system hardening rather than straightforward software updates. Given the rootkit's kernel-level operation, detection and removal are challenging, often requiring offline analysis or system reinstallation. The perpetual lifetime tag indicates that these rootkits remain relevant threats due to the ongoing use of Netfilter in Linux systems and the continuous evolution of rootkit techniques.

Detailed information about Netfilter Rootkit Samples - F. Roth - Google sheet + expansion. Get real-time updates, technical details, and mitigation strategies.

Netfilter Rootkit Samples - F. Roth - Google sheet + expansion - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - LoJax Command and Control Domains Still Active

LoJax is a sophisticated rootkit malware known for its capability to persist on infected systems by implanting itself into the UEFI (Unified Extensible Firmware Interface) firmware, making it extremely difficult to detect and remove. The malware is associated with advanced persistent threat (APT) groups and has been used in targeted espionage campaigns. The specific threat highlighted here is that the command and control (C2) domains used by LoJax remain active as of the reported date, indicating ongoing potential for communication between infected hosts and attacker infrastructure. This persistence of C2 domains suggests that attackers may still be able to control or update the malware on compromised systems, potentially leading to data exfiltration, espionage, or further system compromise. Although the severity is reported as low, this may reflect the limited scope or current exploitation status rather than the inherent risk of the malware itself. The rootkit’s ability to survive system reinstallation and firmware updates makes it a particularly insidious threat, as traditional endpoint security measures may fail to detect or eradicate it. The lack of known exploits in the wild at the time of reporting may indicate limited active use, but the presence of active C2 infrastructure means the threat remains viable. The technical details indicate a moderate threat level and analysis confidence, with a moderate certainty of the OSINT information. The malware’s classification as a rootkit tool underlines its stealth and persistence capabilities.

Detailed information about OSINT - LoJax Command and Control Domains Still Active. Get real-time updates, technical details, and mitigation strategies.

OSINT - LoJax Command and Control Domains Still Active - Live Threat Intelligence - Threat Radar | OffSeq.com

The Umbreon Linux rootkit is a malware threat targeting Linux systems on both x86 and ARM architectures. Named after a Pokémon character, this rootkit is designed to stealthily compromise affected systems by gaining root-level access and hiding its presence from standard detection mechanisms. Rootkits operate by modifying core system components such as kernel modules or system binaries to intercept system calls, thereby concealing files, processes, and network connections associated with the malware. The Umbreon rootkit's cross-architecture capability indicates it can infect a wide range of devices, from traditional servers and desktops (x86) to embedded systems and IoT devices (ARM). Despite being reported in 2016 and classified with a low severity rating, the rootkit's ability to maintain persistent, privileged access poses a significant risk. The absence of known exploits in the wild suggests limited active campaigns or successful infections; however, the potential for targeted attacks remains. The rootkit's stealth features complicate detection and removal, often requiring deep forensic analysis or system reinstallation. Given the lack of specific affected versions or patches, mitigation relies heavily on proactive detection and system hardening. The threat level and analysis scores indicate moderate concern but not immediate widespread danger. Overall, Umbreon exemplifies the ongoing risk posed by sophisticated Linux rootkits capable of evading detection and compromising system integrity across diverse hardware platforms.

Detailed information about OSINT - PokÃ©mon-themed Umbreon Linux Rootkit Hits x86, ARM Systems. Get real-time updates, technical details, and mitigation strateg

Title	Severity	Type	Source	Date

Threats Tagged 'malware_classification:malware-category="rootkit"'

Filter Threats