ext4Malware
Last reported 7 months ago, by JPCERT/CC Eyes3 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1014Rootkit
“Although a connection was visible, no corresponding process ID (PID) could be found, raising suspicions of a rootkit or anti-forensics technique at play.”
- T1036Masquerading
“Masquerading of Backdoor Process”
- T1213.005Messaging Applications
“Primary intrusion vectors included the abuse of leaked credentials obtained through encrypted messaging applications such as Telegram and Signal, marketplace forums, and initial access brokers.”
- T1218.002Control Panel
“…itecture, C2 protocol specifications, server rotation practices, and operational aspects of the user interface suggested that the C2 control panel may have been operated through macro-based automation or via a console interface.”
- T1564Hide Artifacts
“This method has since been officially added to the MITRE ATT&CK framework as T1564.013 – Hide Artifacts: Bind Mounts.”
- T1564.013Bind Mounts
“An unpublished anti-forensics tactic, now cataloged in MITRE ATT&CK as T1564.013 (Linux bind mount abuse), played a central role in the campaign’s stealth.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
JSAC2026 -Day 2-“Following the Trace: Reconstructing Attacks from Ext4 and XFS Journals”
-
UNC2891 Bank Heist: Physical ATM Backdoor & Linux Forensic Evasion“/dev/vda1 on /proc/8914 type ext4 (rw,relatime,errors=remount-ro,data=ordered)”
-
Signaling from within: how eBPF interacts with signals“tmpfs, ext4, xfs, and many other filesystems will check if a fatal signal is pending before starting a write.”
Thanks — we review every report.