It is an AI-generated #Linux #malware which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, #rootkit #hideproc, tries to hide the Koske miner from file listings and processes.
https://malwarelab.eu/posts/koske-panda-ai/
Video from #anyrun analysis:
"#Malware maker sponsors a #shitpost by a #TechIlliterate #Windows n0ob to sell their #Rootkit to #TechIlliterates" would'nt be as clickbaity but a #HonestVideoTitle instead...
PoC #rootkit #Curing evades traditional #Linux detection systems
https://securityaffairs.com/177098/hacking/poc-rootkit-curing-evades-traditional-linux-detection-systems.html
#securityaffairs #hacking
#Hackers can now bypass #Linux #security thanks to terrifying new Curing #rootkit
https://betanews.com/2025/04/24/hackers-bypass-linux-security-with-armo-curing-rootkit/
Whoa, hold up! 
There's a new Linux rootkit dubbed "Curing" out in the wild, and it's got a nasty trick: leveraging `io_uring` to slip right past traditional security tools. Why? Because most of those tools are laser-focused on system calls... which `io_uring` can bypass.
So, what's the deal with `io_uring`? Picture an application chatting directly with the kernel, essentially skipping the front desk where system calls usually check-in. "Curing" exploits this direct line for its command-and-control communication, leaving *none* of the usual suspicious system call footprints. Talk about stealth mode! And heads up – Google has actually been warning about the potential risks here for some time.
Speaking from a pentester's perspective, this is yet another stark reminder: just relying on "basic" security isn't going to cut it. We really need to dive deeper, get our hands dirty with kernel-level analysis and understanding. Let's be clear: running automated scans is *not* the same as a thorough penetration test!
What about you? Are you utilizing `io_uring` in your environment? What kind of security measures have you put in place around it? Seriously curious – how do you see kernel security evolving from here? Let's discuss! 
"Passwort" Folge 25: Staatlich sanktionierte Schnüffelsoftware
Dieses Mal nehmen sich die Podcast-Hosts eines kontroversen Themas an: Unternehmen installieren über Sicherheitslücken Malware - und das in staatlichem Auftrag.
"Passwort" Folge 23: Schnitzeljagd um ein Linux-Bootkit
Sicherheitsforscher finden zufällig die Malware "Bootkitty" und analysieren sie. Was kann sie und wer steckt dahinter? Christopher und Sylvester rätseln mit.
"Passwort" Folge 23: Schnitzeljagd um ein Linux-Bootkit
Sicherheitsforscher finden zufällig die Malware "Bootkitty" und analysieren sie. Was kann sie und wer steckt dahinter? Christopher und Sylvester rätseln mit.
BlackPill is a stealthy Linux rootkit made in Rust.
@hon1nbo @foone As a matter if fact, both #Valve and #cheaters are looking into that already as a means to [combat / do] #cheating in games, as a external machine that intercepts #HDMI / #DisplayPort & #USB could make "undetectable" cheats except if it's resulting in players to become too good to be true...
PUMAKIT, a sophisticated rootkit that uses advanced stealth mechanisms – Source: securityaffairs.com https://ciso2ciso.com/pumakit-a-sophisticated-rootkit-that-uses-advanced-stealth-mechanisms-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #hacking #Malware #PUMAKIT #Rootkit
New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection
https://thehackernews.com/2024/12/new-linux-rootkit-pumakit-uses-advanced.html
The Latest Linux Rootkit PUMAKIT Mastering Stealth Evasion
Are you ready to dive into the world of cybersecurity and explore the latest Linux rootkit, PUMAKIT? Buckle up, because we're about to take a deep dive into this sophisticated loadable kernel module (LKM)
#Linux #Rootkit #PUMAKIT #CyberSecurity #StealthEvasion #Hacking #InfoSec #Malware #TechTrends #DigitalSecurity #hack #privacy #news #tech #hackers
https://cloudhosting.evostrix.eu/the-latest-linux-rootkit-pumakit-mastering-stealth-evasion/
#SaltTyphoon hackers backdoor #telcos with new #GhostSpider #malware
The backdoor was discovered by Trend Micro, which has been monitoring Salt Typhoon's attacks against critical infrastructure and government organizations worldwide.
Along with GhostSpider, Trend Micro discovered that the threat group also uses a previously documented #Linux backdoor named '#MasolRAT,' a #rootkit named '#Demodex,' and a modular backdoor shared among #China #APT groups named '#SnappyBee.'
https://www.bleepingcomputer.com/news/security/salt-typhoon-hackers-backdoor-telcos-with-new-ghostspider-malware/
"Passwort" Folge 17: News von Cybercrimegruppen bis zu Zertifikatsplänen
Im Security-Podcast geht es dieses Mal um Aktionen gegen Kryptobörsen, neue Spectre-Varianten, eine variantenreiche Linux-Malware und Apples Zertifikatsideen.
#North #Korea-linked #APT #Citrine Sleet exploit #Chrome zero-day to deliver #FudModule #rootkit
https://securityaffairs.com/167848/hacking/north-korea-linked-apt-exploited-chrome-zero-day-cve-2024-7971.html
#securityaffairs #hacking
Some thoughts on North Korea hacking a bunch of crypto bros with a Chromium exploit two weeks ago:
1. We all owe #crypto bros a big "thank you" for drawing most of the incoming fire from highly skilled financial threat actors. The irreversible nature of crypto transactions coupled with the lack of technical literacy and high gullibility revealed by buying a monkey JPG for the price of a small house makes it almost pointless for #LazarusGroup to bother targeting any other kind of person so to the bros I say: thank you for all that you do to keep us safe 
.
2. Very fitting that North Korea's crypto stealing rootkit is named #FudModule. Almost too good, really.
More on FudModule: https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/
Microsoft presser: https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/
