SingularityMalware
According to its author, this is a stealthy Linux Kernel Rootkit for modern kernels (6x).From MISP Galaxy
Last reported 2 days ago, by Help Net Security5 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1014Rootkit
“Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft”
- T1204.005Malicious Library
“Userspace interposition affects only processes that load the malicious library (or are injected into).”
- T1546.017Udev Rules
“… guarantee re-execution upon system restart, the loader ensures persistence by installing mechanisms such as systemd units, cron jobs, udev rules, or modifications to initialization scripts.”
- T1036Masquerading
“Masquerading as legitimate processes”
- T1070.006Timestomp
“Once a rootkit is finished clearing its traces, it may timestomp the files it altered to ensure no file modification trace is left behind:”
- T1205.001Port Knocking
“The example below shows Reptile’s port knocking functionality, where the kernel thread forks, changes its session ID to 0, and sets up the network connection:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
SentinelOne brings runtime threat detection and response to AI agents“SentinelOne has unveiled Singularity Agentic Detection and Response (ADR), a new offering that discovers AI agents, enforces what agents are allowed to do, monitors agent behavior in depth, and detects and stops unintended and malicious activity in real time.”
-
SentinelOne extends Wayfinder coverage across endpoints, identities, and cloud workloads“It’s the latest offering from SentinelOne’s Wayfinder team and combines the power of SentinelOne’s AI-powered Singularity Platform telemetry with expert human-led hunting to protect the attack surface across AI, endpoints, identities, and cloud workloads.”
-
ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response“New Connectors for Interactive Sandbox and Threat Intelligence Lookup (via Singularity Hyperautomation):”
-
Hooked on Linux: Rootkit Detection Engineering“An example is Singularity, which provides a load_and_persistence.sh script, which performs several actions, after which it eventually calls insmod "$MODULE_DIR/$MODULE_NAME.ko".”
-
Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft“Recent rootkits such as KoviD, Singularity, and Umbra have utilized ftrace-based hooks.”
Indicators in its reports
named in the reports above- auditd[.]datain 1 report
- config[.]fishin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.