DirtyDecryptMalware
RansomwareFrom MISP Galaxy
Last reported 1 month ago, by Elastic Security Labs2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1505.003Web Shell
“…accommodates any depth of intermediate processes, and folding in service accounts (uid >= 1000, or www-data, nginx, tomcat) covers the web-shell-to-root path that the sequence rules can miss.”
- T1548Abuse Elevation Control Mechanism
“This category maps to the Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001) technique on the MITRE ATT&CK matrix.”
- T1548.001Setuid and Setgid
“This category maps to the Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001) technique on the MITRE ATT&CK matrix.”
- T1552.004Private Keys
“Instead, root-only material leaves the boundary: SSH host private keys, /etc/shadow, or an authenticated privileged IPC connection.”
- T1611Escape to Host
“…e rules by needing no root transition at all, which makes it a broader hunting and triage signal (and a noisier one), useful for the escape-to-host case that the correlation rules would never see.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Linux Detection Engineering - Local Privilege Escalation“Copy Fail opened in April 2026, and DirtyFrag, Fragnesia, DirtyDecrypt, and DirtyClone pushed the identical idea through ESP, RxRPC, and the socket-buffer fragment helpers within weeks.”
-
Exploits and vulnerabilities in Q2 2026“CVE-2026-31635 (DirtyDecrypt): a Linux kernel vulnerability that lets a local attacker escalate privileges due to improper handling of decryption operations and page cache data modification”
Indicators in its reports
named in the reports above- process.parent[.]pidin 1 report
- auditd[.]datain 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.