TripleCrossMalware
According to its author, TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology.From MISP Galaxy
Last reported 7 months ago, by Elastic Security Labs1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1014Rootkit
“Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft”
- T1204.005Malicious Library
“Userspace interposition affects only processes that load the malicious library (or are injected into).”
- T1542.003Bootkit
“…nity and widespread usage in enterprise environments drive ongoing innovation, including techniques like DKOM, PatchGuard bypasses, and bootkits.”
- T1546.017Udev Rules
“… guarantee re-execution upon system restart, the loader ensures persistence by installing mechanisms such as systemd units, cron jobs, udev rules, or modifications to initialization scripts.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft“Two prominent public examples are TripleCross and Boopkit.”
Thanks — we review every report.