#RootKit - Twitter Hashtag

4 days ago

I analyzed Trend Micro Deep Security Agent for Linux and found that a local event storm can force bmhook/tmhook reload cycles, opening a repeatable temporary protection bypass window. Full write-up: https://t.co/bZFOyMptG5 #linux #edr #rootkit #cybersec #security #research

MatheuzSecurity's tweet photo. I analyzed Trend Micro Deep Security Agent for Linux and found that a local event storm can force bmhook/tmhook reload cycles, opening a repeatable temporary protection bypass window.

Full write-up:

https://t.co/bZFOyMptG5

#linux #edr #rootkit #cybersec #security #research https://t.co/lbSLoEn3fi

1

48

18

20

3K

Gray Hats @the_yellow_fall

26 days ago

Gen Digital exposes a JDownloader site breach (May 6-7, 2026). Attackers used WDAC policies to kill antivirus and r77 rootkits for total system invisibility. #JDownloader #SupplyChainAttack #CyberSecurity #InfoSec #Malware #Rootkit #WindowsDefender #WDAC https://t.co/FthRZCHoEE

the_yellow_fall's tweet photo. Gen Digital exposes a JDownloader site breach (May 6-7, 2026). Attackers used WDAC policies to kill antivirus and r77 rootkits for total system invisibility.

#JDownloader #SupplyChainAttack #CyberSecurity #InfoSec #Malware #Rootkit #WindowsDefender #WDAC
https://t.co/FthRZCHoEE https://t.co/3RwRlc7wW9

0

7

1

2

544

Gray Hats @the_yellow_fall

27 days ago

Flare unmasks PamDOORa: a $1,600 Linux backdoor that hijacks the PAM stack to harvest credentials and manipulate authentication logs to evade detection. #PamDOORa #LinuxSecurity #CyberSecurity #InfoSec #Malware #Rootkit #SSH #SysAdmin #LinuxServer https://t.co/NcNsBShXTi

the_yellow_fall's tweet photo. Flare unmasks PamDOORa: a $1,600 Linux backdoor that hijacks the PAM stack to harvest credentials and manipulate authentication logs to evade detection.

#PamDOORa #LinuxSecurity #CyberSecurity #InfoSec #Malware #Rootkit #SSH #SysAdmin #LinuxServer
https://t.co/NcNsBShXTi https://t.co/la5eR1qNq9

0

9

2

4

667

Oluseye | Cybersecurity @cybrsecured

about 1 month ago

Rootkit Horror 😬 Rootkits are scary because: They hide DEEP inside systems. Like: A thief living in your walls rent-free 😭 Hardest part? A) Detecting it B) Removing it C) Both 👇 #Rootkit #Malware

cybrsecured's tweet photo. Rootkit Horror 😬

Rootkits are scary because:

They hide DEEP inside systems.

Like:
A thief living in your walls rent-free 😭

Hardest part?

A) Detecting it
B) Removing it
C) Both

👇
#Rootkit #Malware https://t.co/N4qhcnUjDT

3

2

0

776

Gray Hats @the_yellow_fall

about 1 month ago

Trend Micro uncovers QLNX, a fileless Linux RAT targeting AWS, NPM, and Kubernetes keys. Learn how its eBPF rootkit hides from even the deepest system scans. #QLNX #LinuxSecurity #DevOps #SupplyChain #CyberSecurity #InfoSec #Rootkit #eBPF https://t.co/WJSEdA41XD

the_yellow_fall's tweet photo. Trend Micro uncovers QLNX, a fileless Linux RAT targeting AWS, NPM, and Kubernetes keys. Learn how its eBPF rootkit hides from even the deepest system scans.

#QLNX #LinuxSecurity #DevOps #SupplyChain #CyberSecurity #InfoSec #Rootkit #eBPF
https://t.co/WJSEdA41XD https://t.co/kd0FfeY0Kd

1

10

2

4

613

Gray Hats @the_yellow_fall

about 1 month ago

Quasar Linux (QLNX) is a stealthy new rootkit targeting GitHub, AWS, and Kubernetes environments to hijack credentials and poison the software supply chain. #QuasarLinux #QLNX #LinuxSecurity #SupplyChainAttack #DevSecOps #CyberSecurity #Malware #Rootkit https://t.co/aYcC30bzOe

the_yellow_fall's tweet photo. Quasar Linux (QLNX) is a stealthy new rootkit targeting GitHub, AWS, and Kubernetes environments to hijack credentials and poison the software supply chain.

#QuasarLinux #QLNX #LinuxSecurity #SupplyChainAttack #DevSecOps #CyberSecurity #Malware #Rootkit
https://t.co/aYcC30bzOe https://t.co/SDWb8JLL8V

0

3

2

1

448

Aliakbar Zahravi @AliakbarZahravi

about 1 month ago

🚨 New Research: Quasar Linux (QLNX) Stage 0 - Initial Foothold: How the malware opens the gate to the software supply chain through covert compromise of developer's environment 📖Full technical details: https://t.co/9prEGjkewp #Malware #ThreatIntel #rootkit

AliakbarZahravi's tweet photo. 🚨 New Research: Quasar Linux (QLNX)

Stage 0 - Initial Foothold: How the malware opens the gate to the software supply chain through covert compromise of developer's environment

📖Full technical details:
https://t.co/9prEGjkewp

#Malware #ThreatIntel #rootkit https://t.co/hMEzh4vUKC

1

3

0

139

kaxm @kaxm231

about 1 month ago

am building a full red team Linux implant: → Kernel rootkit (hides files/threads/sockets/self) → Process injection (ghost in gnome-shell) → Polymorphic payload (unique each deploy) → ChaCha20 C2 + encrypted UDP here the architect #redteam #linux #rootkit

kaxm231's tweet photo. am building a full red team Linux implant:
→ Kernel rootkit (hides files/threads/sockets/self)
→ Process injection (ghost in gnome-shell)
→ Polymorphic payload (unique each deploy)
→ ChaCha20 C2 + encrypted UDP
here the architect #redteam #linux #rootkit https://t.co/l5IyvTqjLY

1

2

0

1

136

Szabolcs Schmidt

@smica83

about 2 months ago

Another #WHQL #signed #rootkit seen from Germany @abuse_ch https://t.co/1Ae4XMx7Af

0

2

1

355

Szabolcs Schmidt

@smica83

about 2 months ago

Some #rootkit, signed by #WHQL again. Seen from China @abuse_ch https://t.co/EqHfk9SQDC

1

5

2

0

649

Szabolcs Schmidt

@smica83

about 2 months ago

'1.sys' looks like a Microsoft signed #rootkit @abuse_ch https://t.co/t4dGQzi5ls

0

4

1

4

455

AnMioLink @anylink20240604

about 2 months ago

A variant of #RegPhantom Rootkit. Signed by "Microsoft Windows Hardware Compatibility Publisher" (Valid signature) https://t.co/BfjyRrYTao #Rootkit #RegPhantom #Signed #WHCP #WHQL #Threat_Intelligence

0

7

2

3

571

Gray Hats @the_yellow_fall

2 months ago

McAfee unmasks Operation NoVoice: a sophisticated Android rootkit that survives factory resets to clone WhatsApp sessions and seize full device control. #OperationNoVoice #AndroidSecurity #WhatsAppHijack #CyberSecurity #MobileMalware #Rootkit #InfoSec https://t.co/GTak0u1l7J

the_yellow_fall's tweet photo. McAfee unmasks Operation NoVoice: a sophisticated Android rootkit that survives factory resets to clone WhatsApp sessions and seize full device control.

#OperationNoVoice #AndroidSecurity #WhatsAppHijack #CyberSecurity #MobileMalware #Rootkit #InfoSec
https://t.co/GTak0u1l7J https://t.co/lNUCDhzBmL

0

10

4

1

433

Gray Hats @the_yellow_fall

3 months ago

Nokia researchers uncover the Katana botnet, a Mirai variant using custom rootkits to hijack unmanaged Android TV boxes in a massive IoT turf war. #KatanaBotnet #AndroidTV #CyberSecurity #IoT #Malware #InfoSec #Botnet #NokiaERT #TechNews #Rootkit https://t.co/N4sscJ7Wp1

the_yellow_fall's tweet photo. Nokia researchers uncover the Katana botnet, a Mirai variant using custom rootkits to hijack unmanaged Android TV boxes in a massive IoT turf war.
#KatanaBotnet #AndroidTV #CyberSecurity #IoT #Malware #InfoSec #Botnet #NokiaERT #TechNews #Rootkit
https://t.co/N4sscJ7Wp1 https://t.co/pRQXIjzvAi

1

11

7

2

825

MatheuZ @MatheuzSecurity

4 months ago

I just released ksentinel - a Kernel Syscalls Integrity Monitor. It continuously verifies critical syscall paths, function, the syscall table, and LSTAR MSR to detect common kernel hooking techniques targeted by rootkits https://t.co/f1oks7rcpi #rootkit #linux #forensics

0

84

20

42

5K

reverseame @reverseame

4 months ago

Singularity: Deep Dive into a Modern Stealth Linux Kernel Rootkit #Singularity #LinuxKernel #Rootkit #FtraceHooking #StealthEvasion https://t.co/RwkwwRZc2h

1

36

5

14

2K

MatheuZ @MatheuzSecurity

4 months ago

New blog post: eBPF security has blind spots at the kernel level. When the kernel is compromised, telemetry can lie. https://t.co/NLiHurgFg2 #linux #rootkit #singularity #evasion #ebpf #malware #infosec

1

130

33

85

6K