Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Organizations should combine the NVD and CISA KEV catalog to prioritize vulnerabilities effectively, focusing on managing real risks rather than being overwhelmed by theoretical scores and alert fatigue.. To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the NVD provides baseline technical metrics aligned with the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 47 articles for you...
83
security advisorymalwarerootkitZero-Day Rootkits: Navigating Advanced Threats in Linux Environments
Since Linux has become such an indispensable backbone of servers, embedded systems, and IoT devices across industries, its attractiveness as a target of sophisticated cyber threats has increased substantially. Recently, Fortinet researchers made headlines when they unearthed an advanced rootkit malware preying on Linux systems by exploiting zero-day vulnerabilities to gain control and avoid detection - an alarming discovery for us admins responsible for safeguarding against evolving threats to secure their Linux environments. . Here, we explore details regarding this malware and implications and best practices for safeguarding your Linux systems against emerging malware threats. A Deeper Look into the Advanced Rootkit Malware This latest rootkit malware stands out for its sophisticated infiltration and persistence methods. Accessed through an innocent-appearing shell script named Install.sh, this piece of malware achieves complete system penetration and deep integration that allows attackers to intercept network traffic and remotely manipulate compromised devices. While lesser threats might compromise system performance or generate warnings through apparent modifications, this rootkit has been designed with subtlety in mind. Its goal is to blend into Linux environments, obfuscating detection by antivirus software systems. Zero-day vulnerabilities are at the core of this malware's success, enabling it to bypass traditional security measures and install rootkits undetected. Not having been previously identified or patched, these zero-day flaws provide attackers with an avenue for installation without setting off alarms - showing once again why proactive risk management practices must include testing systems for potential weaknesses and engaging regularly with cybersecurity communities to keep informed of emerging threats. Understanding The Significance for Security Administrators Rootkit malware has become a serious concern for Linux admins. When uptime and reliability are critical, anyundetected rootkit presence could result in in data breaches , unwarranted access to sensitive data, and even system downtime - potentially disastrous repercussions for all involved. Furthermore, its ability to hijack network traffic threatens infected devices and potentially even entire networks, as this malware can subtly exfiltrate data remotely. Given these risks, we must adopt a holistic approach to security. This requires going beyond simply patching known vulnerabilities with practices designed to ensure system integrity and resilience against unknown threats. Regular system updates , carefully reading security advisories , and installing robust intrusion detection systems all play key roles in an effective security strategy. Best Practices for Mitigating Advanced Malware Threats Combating advanced malware like this rootkit requires a multilayered security strategy. Logs provide a window into what activities are taking place within a system, and by setting alerts for unusual activities or anomalies, administrators can identify potential threats in advance. For instance, suspicious logins, unexpected network activity, or attempts at configuration changes should trigger immediate investigations. Protecting startup scripts is also of utmost importance, as malicious actors often target these scripts to ensure their malware runs every time a system boots up. By applying strict permissions and auditing startup scripts regularly, administrators can protect themselves from any alterations or additions by any malicious actors that might attempt to target these startup scripts. Network monitoring is also an integral component of threat detection and mitigation. Traffic analysis can reveal anomalies that are not immediately noticeable at the system level. Network security tools that inspect outgoing and incoming connections may reveal irregular patterns or communications from known malicious IPs. Access controls are another essential tool in the fight against malware. By following theprinciple of least privilege, users and applications only receive the permission they need for their functions - reducing any entry points for malware. Regular audits help refine these controls further and identify any unnecessary rights that require removal. Rootkit detection tools can also significantly enhance an organization's defense capabilities. These tools are specifically designed to identify hidden threats that evade traditional security solutions, so security admins should integrate rootkit detection tools into their regular scanning routines and ensure they are frequently updated to recognize new rootkit variants. Our Final Thoughts on The Rising Threat of Zero-Day Rootkits in Linux Environments The discovery of this advanced rootkit malware aimed at Linux systems is a stark reminder of the rapid advancement of cyber threats, highlighting their ever-increasing sophistication and pervasive nature. For us security administrators, it highlights the necessity of taking an integrated and proactive approach to security. Understanding these complex attacks while taking measures such as using up-to-date tools and techniques and instilling security-first cultures can better protect organizations against not only this rootkit but future threats as well to ensure system integrity while safeguarding essential data. . Delve into sophisticated threats posed by rootkit malware within Linux systems and discover effective strategies to enhance the security of your digital landscapes.. Linux Rootkit Threats, Cybersecurity Best Practices, Advanced Malware Defense, Secure Linux Systems. . Brittany Day
Jan 14, 2025
•
Hacks/Cracks
83
Linux securityrootkitthreat detectionPUMAKIT Rootkit Analysis: Multi-Stage Malware and Evasion Techniques
The recently discovered PUMAKIT loadable kernel module (LKM) rootkit stands out as an advanced example of multi-stage malware, operating over multiple stages to avoid detection and establish control on targeted systems. It does not simply plant malicious software; instead. It involves an intricate web of activities starting with droppers, memory executables, and rootkits before finally arriving at its final goal - complete control. . Beyond its multilayered architecture, PUMAKIT employs sophisticated evasion techniques to remain undetected. These include hooking into system calls, hiding files and processes from users' views, and altering credentials to maintain control. In this article, we will explore both its multistage structure and the tactics used to remain hidden. This analysis will explain how PUMAKIT operates so you can detect and defend against such advanced threats to your Linux systems. Understanding Multi-Stage Malware An understanding of multi-stage malware is necessary to fully comprehend PUMAKIT's complexity. Unlike traditional forms of malware that execute one action at a time, multi-stage threats typically carry out attacks over multiple stages. This starts with initial infections followed by escalated actions designed to ensure they become deeply entrenched within a system. PUMAKIT begins its attack with a dropper, an item of malicious code designed solely to gain entry. Once executed successfully, this code fetches additional payloads--usually in-memory executables--prepared for later stages. Due to this multilayered approach, detection is far more challenging since each stage can be designed to bypass security measures. Examining PUMAKIT's Dropper PUMAKIT's dropper is the foundation of its multi-stage attack strategy. Think of it as an opening act that gives more sinister elements access. Once deployed, the Dropper ensures that system configuration allows further malicious payloads, whether exploiting vulnerabilities within or using social engineering tactics toconvince users to grant necessary permissions. Once inside, the dropper often uses various means to obscure its presence, including self-destructing after running, so security software has more difficulty tracking its source. This initial phase aims to establish the malware with minimum suspicion raised. Memory Executables: Silent Operators Once the dropper has accomplished its task, in-memory executables take over. Traditional malware often leaves traces easily identified by security software, while PUMAKIT's in-memory executables operate directly within RAM instead, making them harder to detect. Executables perform key tasks that set the foundation for rootkit deployment in their final stage: manipulating system processes, opening backdoors for remote access, or disabling certain security features. Stealth is key. Operating in memory enables these components to complete their mission without leaving an evidence trail that investigators could quickly discover and analyze. Unpacking PUMAKIT's Rootkits Step two in PUMAKIT's multi-stage attack involves installing rootkits - specifically LKM (Loadable Kernel Module) and Kitsune SO userland rootkits - into the system to allow attackers to access and control them persistently. Rootkits pose a particular danger because they operate at low levels within systems, enabling attackers to gain persistent control and access over them. The LKM rootkit integrates deeply within the kernel, the central portion of an operating system. It can intercept system calls, modify service behavior, and conceal itself and any related malicious activities from view. The Kitsune SO userland rootkit is another advanced rootkit adept at hiding processes, files, and network activities from regular security measures. Together, these rootkits form a formidable defense against detection, making it virtually impossible to spot compromised systems using standard measures alone. Advanced Evasion Techniques Modern Linux rootkits like PUMAKIT utilize sophisticatedevasion techniques to remain undetected, such as syscall hooking using ftrace. By hooking into system calls, they can manipulate what the system reports back to a user or admin. For instance, by intercepting system requests and returning false information, everything appears normal when, in fact, anything goes amiss. PUMAKIT utilizes anti-debugging strategies as another weapon against security analysts attempting to understand its behavior. By recognizing and counteracting attempts to debug its processes, PUMAKIT effectively blocks this type of analysis by looking for debuggers or using timing checks to detect irregularities that indicate monitoring activity. PUMAKIT excels at concealing network connections - which is essential for maintaining undetected access to the compromised system. By manipulating network stack data to hide its communication channels and ensure outbound traffic doesn't raise red flags, PUMAKIT can maintain an undetectable backdoor into compromised systems. Credential Modification: An Unseen Hand Credential modification is another underhanded tactic employed by PUMAKIT. By exploiting functions such as prepare_creds and commit_creds, the malware can escalate privileges or gain permissions that would usually be restricted - making it easier for attackers to commit other illegal actions without drawing too much attention to themselves. Once in place, rootkits can modify key system processes' credentials by giving them elevated permissions, effectively giving an attacker unbridled power while still remaining undetected by standard security protocols. Understanding PUMAKIT's Impact on Linux Security PUMAKIT and other multi-stage malware present significant security challenges to Linux system security, with traditional security measures often ineffective against such complex threats. First and foremost, in-memory executables and rootkits require shifting away from disk-based detection methods in favor of solutions that focus on behavioral analysis and memory forensics.Furthermore, regularly updating and patching systems against vulnerabilities that droppers may exploit is equally essential. Practical Detection and Mitigation Strategies for Admins Early detection of PUMAKIT relies on both stringent access controls and continuous monitoring. An intrusion detection system (IDS) , configured to identify unusual behavior, such as hidden network connections or unexpected credential modifications, can provide early warning. Due to the complexity of multi-stage malware like PUMAKIT, its detection and prevention requires a multifaceted approach. Implementing endpoint detection and response (EDR) solutions that monitor behaviors rather than signature-based threats will be more successful. Such solutions look for any abnormal system activity that might indicate that in-memory executables or rootkits are present on a system. Kernel integrity checkers can assist in detecting any modifications made by LKM rootkits that alter your kernel, making auditing and integrity checks part of any effective security strategy. Regular system audits should also be conducted. Tighter access controls may help delay or even prevent initial infiltration by droppers. Utilizing the principle of least privilege ensures that even if an attacker gains an entry point, their presence won't quickly expand without raising alarms. Our Final Thoughts on Addressing & Learning From PUMAKIT Cyberwar is constantly changing, and multi-stage malware like PUMAKIT offers attackers new avenues for exploitation. With its multiple layers of infection processes and advanced evasion techniques, PUMAKIT poses an extraordinary threat to security professionals. By understanding its operation- from initial dropper deployment to rootkit installation- you can better defend against it and prepare your systems against attack. Staying one step ahead of such advanced threats requires constant vigilance and in-depth knowledge of your system's normal operations and sophisticated detection tools. By adapting tothese complex threats and taking measures that combine traditional and modern security methods, you can significantly lower your risk and protect your Linux environment from multi-stage malware threats. . COSMICWIND poses a formidable threat to Linux security, employing layered strategies and sophisticated avoidance methods.. rootkit evasion techniques, multi-stage malware analysis, Linux threat detection. . Brittany Day
Dec 16, 2024
•
Hacks/Cracks
83
security advisoryrootkitbrute forceCentOS 7: TeamTNT Attack Advisory moderate: Brute Force Total Compromise
Security researchers have recently observed an alarming resurgence of TeamTNT , a notorious hacking group known for targeting cloud infrastructures. Their latest campaign zeroes in on Virtual Private Server (VPS) environments running CentOS, particularly version 7. . On a broader scale, this threat highlights the growing complexity of securing cloud infrastructure and the risks associated with running outdated systems like CentOS 7. To help you better understand and proactively address this emerging threat, I'll discuss the nature of these attacks, what makes CentOS 7 an attractive attack target, and practical steps Linux admins and organizations can take to mitigate risk. The Anatomy of the Attack TeamTNT's attack methodology has evolved over the years, making it a significant threat to cloud infrastructures. The latest campaign begins with a Secure Shell (SSH) brute force attack on the target's assets. Once access is gained, a malicious script is uploaded, which initiates a series of harmful actions to compromise the server's security. The script is multifaceted, involving the following tactics and steps: Disable Security Features: It starts by disabling the existing security mechanisms to avoid detection. Log Deletion & System Modification: It deletes logs and modifies crucial system files to cover its tracks. Crypto Miner Killer: The script searches for and kills existing cryptocurrency mining processes, ensuring that TeamTNT can monopolize the system's resources. DNS Setting Changes: DNS settings are altered to Google’s servers, possibly to bypass existing security filters. Rootkit Installation: The script installs the Diamorphine rootkit , a loadable kernel module that covertly allows the attacker to execute malicious activities. Backdoor Creation: It also creates a backdoor user with root access and installs a public key for secure access. The Diamorphine rootkit provides covert capabilities such as silent execution, hiding processes,and allowing the attacker to gain root access at will. Additionally, the script further locks down the system by modifying file attributes, making it difficult for administrators to unlock and recover protected files. Why Is CentOS 7 Particularly Vulnerable? CentOS 7, while widely used, is particularly vulnerable for several reasons: Discontinued Support: Although still prevalent, CentOS 7 no longer receives regular updates and security patches, making these systems an easy target for attackers. Older Kernel Vulnerabilities: CentOS 7 runs on older Linux kernel versions, which may contain vulnerabilities that have been patched in later releases. Usage in Cloud Environments: CentOS 7 is commonly used in VPS and cloud environments, making it an attractive target for cryptojacking and other resource-intensive attacks. These inherent vulnerabilities and often lax security practices in cloud setups make CentOS 7 an ideal target for TeamTNT's malicious campaigns. TeamTNT's Resurgence Highlights The Growing Complexity of Securing Cloud Infrastructures The resurgence of TeamTNT underscores a broader trend: the increasing complexity of securing cloud environments. The attack surface has significantly expanded with the rapid adoption of cloud-native technologies like Kubernetes and Docker. Sophisticated threat actors can easily exploit misconfigurations and weak security practices. As cloud deployments become more complex, so do threat actors' tactics, requiring organizations to evolve their security measures continually. Practical Mitigation Strategies for Admins & Organizations To protect against these sophisticated attacks, Linux administrators must adopt a multi-layered security approach. Here are some specific and practical steps they can implement: Strengthen SSH Configurations: Use strong, unique passwords or SSH keys for authentication. Disable root login via SSH and create a separate user with sudo privileges. Implement rate limiting and intrusion detectiontools like Fail2Ban to thwart brute force attacks. Regular Updates and Patch Management: Update your OS regularly and apply the latest security patches . For CentOS 7, consider using community-supported repositories for essential updates. Kernel Hardening: Use module signing and disable loadable kernel modules unless necessary. Implement kernel hardening measures like SELinux or AppArmor. Monitor for Rootkits: Employ rootkit detection tools like chkrootkit and rkhunter . Regularly check for unusual system behaviors that could indicate rootkit installation. Secure Containerized Environments: Ensure Docker and Kubernetes configurations follow security best practices. This includes setting resource limits, network segmentation, and enabling role-based access control. Firewall Configuration: Set firewalls to allow only essential services and restrict SSH access to a select set of IP addresses. Enhanced Security Measures: Utilize security tools that rapidly detect and respond to advanced threats. Security Information and Event Management (SIEM) solutions and Intrusion Detection Systems (IDS) can mitigate risks before they escalate. Our Final Thoughts on This Emerging Linux Security Threat The resurgence of TeamTNT serves as a stark reminder of the growing threats to cloud infrastructures. While CentOS 7 remains a popular choice for VPS, its discontinuation and associated vulnerabilities make it an attractive target for sophisticated cybercriminals. By implementing robust security practices, regularly updating systems, and continuously monitoring for threats, Linux administrators can significantly mitigate the risks posed by groups like TeamTNT. Securing cloud environments is an ongoing battle, but organizations can stay one step ahead of malicious actors with the right strategies and tools in place. . Analyzes the emergence of TeamTNT as a formidable menace targeting CentOS VPS, focusing on their tactics, exploited weaknesses, and countermeasures for Linuxsystem administrators.. TeamTNT Threats, Securing CentOS 7, VPS Security Best Practices, Linux Attack Mitigation, Cloud Security Challenges. . Anthony Pell
Sep 23, 2024
•
Hacks/Cracks
83
threatmalwarerootkitKrasue RAT: Remote Access Trojan Targeting Linux in Telecoms
Let me fill you in on a stealthy threat to Linux systems that has flown under the radar for nearly three years! A remote access trojan dubbed "Krasue" has been silently infiltrating Linux systems like yours, primarily targeting telecommunications companies since 2021. . It operates through a sophisticated rootkit including seven variants, each drawing its foundation from different open-source projects. This tricky technique allows the malware to adapt to different Linux kernel versions, making this malware highly difficult to detect and remove. Security researchers have said that the primary objective of the Krasue RAT is to maintain access to the host system. Krasue’s deployment strategy is unknown; possible approaches include credential brute-force assaults, exploiting vulnerabilities, or disguising distribution through unreliable sources that pretend to be trustworthy packages or binaries. So what can you do to stay safe against threats like Krasue? Ensure you have applied the latest patches released by your distro(s) to fix known vulnerabilities that malicious actors could exploit, and subscribe to our newsletters to stay updated on the latest security news, trends, and advisories impacting you. It's a dangerous digital world these days - stay informed and proactive to remain ahead of cybercriminals! . An advanced malware named Krasue targets Linux, exploiting vulnerabilities for remote access. Stay alert and secure!. Krasue RAT, Linux Intrusion, Cybersecurity Threats, Stealthy Malware. . LinuxSecurity.com Team
Dec 21, 2023
•
Hacks/Cracks
77
remote accessmalwarerootkitKrasue RAT Threat: Remote Access and Data Theft Risks for Linux Servers
The Krasue Rat malware is a new threat to Linux servers that has been discovered by security researchers. The malware installs itself on the server, and then hides in the form of a rootkit, allowing it to hide from security software. . The malware uses a variety of techniques to avoid detection, including hiding its file system activity and moving around its files so they are not easily found by scanning programs. It also uses fake certificates and authentication processes to make sure that it doesn't get detected by anti-virus programs. The Krasue Rat malware can be used as both a remote access tool for hackers and as an information stealer for criminals. It also has potential use in targeted attacks against specific organizations or companies, as it could be used to steal sensitive data without being detected. I found the article linked below very helpful in understanding this threat, and I wanted to share it with you. Be sure to give it a read! . Explore the methods by which Krasue RAT malware breaches Linux environments, employing advanced rootkit techniques to remain undetected.. Krasue RAT, Linux Malware, Server Security Threats. . LinuxSecurity.com Team
Dec 07, 2023
•
Server Security
83
security advisoryrootkitdata theftKinsing Attack on ActiveMQ: Rootkit Deployment and Data Theft
A team of Chinese hackers known as Kinsing has discovered a little-known security vulnerability in the Apache ActiveMQ message broker software. The vulnerability allowed the attackers to implant rootkits on Linux servers remotely and steal sensitive information such as usernames, passwords, and SSH keys. . The Kinsing threat group has a history of targeting misconfigured containerized environments for cryptocurrency mining, often utilizing compromised server resources to generate illicit profits for the attackers. According to security researchers, "Once Kinsing infects a system, it deploys a cryptocurrency mining script that exploits the host's resources to mine cryptocurrencies like Bitcoin, resulting in significant damage to the infrastructure and a negative impact on system performance. Kinsing doubles down on its persistence and compromise by loading its rootkit in /etc/ld.so.preload, which completes a full system compromise." The link for this article located at The Hacker News is no longer available. . Kinsing cybercriminals take advantage of Nginx vulnerabilities to install Windows trojans and access private information.. Kinsing Attack, ActiveMQ Security, Linux Exploit, Rootkit Threat. . LinuxSecurity.com Team
Nov 25, 2023
•
Hacks/Cracks
83
access controlmalwarerootkitReptile Rootkit: Advanced Malware Threatening Linux in South Korea
Threat actors are using an open-source rootkit called Reptile to target Linux systems in South Korea. . "Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of systems," the AhnLab Security Emergency Response Center (ASEC) said in a report published this week. "Port knocking is a method where the malware opens a specific port on an infected system and goes on standby. When the threat actor sends a magic packet to the system, the received packet is used as a basis to establish a connection with the C&C server." A rootkit is a malicious software program that's designed to provide privileged, root-level access to a machine while concealing its presence. At least four different campaigns have leveraged Reptile since 2022. The link for this article located at The Hacker News is no longer available. . Stealthy worm Trojan exploits vulnerabilities, employing backdoor tactics, aimed at Unix platforms across Japan.. Reptile Rootkit, Linux Malware, South Korean Systems, Cyber Threats, Rootkit Security. . LinuxSecurity.com Team
Aug 07, 2023
•
Hacks/Cracks
83
malwarerootkitsystem controlNew Reptile Rootkit Attack on Linux: Port Knocking for Control
A new kernel module rootkit malware was released recently on GitHub, dubbed Reptile. It’s an open-source rootkit that has the ability to hide itself, other malicious codes, files, directories, and network traffic. . While, unlike other rootkit malware, Reptile stands out with a reverse shell, enabling easy system control, and its signature move is Port Knocking. Port Knocking opens a specific port on an infected system, connecting it to the C&C server upon receiving an attacker’s Magic Packet. The cybersecurity researchers at ASEC recently identified this new rootkit malware. Reptile aids malware installation and equips attackers with Listener, a command line tool that awaits a reverse shell connection to execute on infected systems, granting control to the attacker. Attackers can operate a reverse shell without specifying the C&C server by forwarding specific packets using Port Knocking. Packet, a command line tool, receives parameters for the reverse shell connection and port knocking method. The link for this article located at CyberSecurity News is no longer available. . Investigate the latest Reptile rootkit malware utilizing port knocking techniques for discreet Linux infiltrations, enabling streamlined system manipulation.. Reptile Rootkit, Linux Malware, Port Knocking, Open Source Threat. . LinuxSecurity.com Team
Jul 26, 2023
•
Hacks/Cracks
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!