PUMAKITMalware
- kitsune
According to Elastic, PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control servers.From MISP Galaxy
Last reported 6 months ago, by Elastic Security Labs5 reports
ATT&CK techniques
6 of 20 · each with the sentence it comes from- T1014Rootkit
“Its multi-stage architecture consists of a dropper (cron), two memory-resident executables (/memfd:tgt and /memfd:wpn), an LKM rootkit module, and a shared object (SO) userland rootkit.”
- T1036Masquerading
“If run usually (without a particular argument), it executes hidden ELF binaries without leaving traces on disk, possibly masquerading as a legitimate process (like cron).”
- T1204.005Malicious Library
“With root access, an attacker can edit the /etc/ld.so.conf file or add configuration fragments to /etc/ld.so.conf.d/ to insert malicious library paths.”
- T1546.017Udev Rules
“… guarantee re-execution upon system restart, the loader ensures persistence by installing mechanisms such as systemd units, cron jobs, udev rules, or modifications to initialization scripts.”
- T1027.009Embedded Payloads
“The malware writes its embedded payloads (tgtElfp and wpnElfp) into anonymous file descriptors rather than dropping them onto disk.”
- T1036.006Space after Filename
“| | Masquerading Space After Filename |”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Hooked on Linux: Rootkit Detection Engineering“Examples of rootkits that leverage this technique include Reptile and PUMAKIT.”
-
Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft“…techniques used by Linux rootkits, illustrating each method with examples and real-world rootkit samples (such as Reptile, Diamorphine, PUMAKIT, and, more recently, FlipSwitch) to understand how they work and how kernel evolution has challenged them.”
-
FlipSwitch: a Novel Syscall Hooking Technique“…yscall hooking, particularly by overwriting pointers to syscall handlers, has been a cornerstone of Linux rootkits like Diamorphine and PUMAKIT, enabling them to hide their presence and control the flow of information.”
-
Linux Detection Engineering - A Continuation on Persistence Mechanisms“Read our recent research, “Declawing PUMAKIT”, a sophisticated LKM rootkit that employs mechanisms to hide its presence and maintain communication with its C2 servers.”
-
Declawing PUMAKIT“Declawing PUMAKIT”
Indicators in its reports
named in the reports above- auditd[.]datain 1 report
- config[.]fishin 1 report
- hxxps://github[.]com/1337-42/FlipSwitch-dev/in 1 report
- hxxps://www.virusbulletin[.]com/conference/vb2025/abstracts/unmasking-unseen-deep-dive-modern-linux-rootkits-and-their-detection/in 1 report
- hxxp://192.168.1[.]100:8080/cmd.php?cmd=whoamiin 1 report
- hxxp://192.168.1[.]100:8080/cgi-bin/reverse.pyin 1 report
- 71cc6a6547b5afda…760699693f24in 1 report
- 30b26707d5fb407e…b3edfc80db1fin 1 report
- crond[.]pidin 1 report
- cb070cc922344511…aaed3c2b3cfein 1 report
- 934955f0411538ee…165c4d104136in 1 report
- l.opsecurity1[.]arin 1 report
- ecurity1[.]artin 1 report
- 89.23.113[.]20in 1 report
- opsecurity1[.]artin 1 report
- 89.23.113[.]204in 1 report
- 8ef63f9333104ab2…e39c94986e27in 1 report
- 8ad422f5f3d04097…4044d0a0ea03in 1 report
- bbf0fd636195d51f…d7d3da8af804in 1 report
- bc9193c2a8ee4780…8bb793172491in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.