Loading malware…
Diamorphine is an open-source Linux kernel rootkit implemented as a loadable kernel module. First publicly available in 2016, it is widely referenced in offensive tradecraft and has been used in real intrusions to provide stealth and privileged control on compromised Linux systems. The rootkit is commonly deployed after attackers already have elevated privileges, including in cloud and container-related compromises where privileged execution or host-level root access is available.
Diamorphine is designed to conceal malicious activity by hooking kernel functionality associated with process and filesystem visibility. Reported capabilities include hiding processes, hiding files or directories, hiding the kernel module itself, and granting root privileges to a process through covert trigger mechanisms. It has also been associated with syscall-hooking approaches and later adaptations using kprobes-related techniques. Because it operates in kernel space, it can be used to mask other payloads such as cryptocurrency miners and to frustrate host-based investigation and remediation.
The rootkit has been repeatedly linked to TeamTNT operations, especially Linux and cloud-focused cryptojacking campaigns targeting exposed or misconfigured infrastructure such as Docker environments, VPS instances, and other Unix-like systems. In these campaigns, Diamorphine has been used alongside XMRig, Tsunami, credential theft tooling, cron-based persistence, SSH backdoors, and scripts that disable security controls, remove competing miners, and impede recovery. It has also been incorporated into offensive tooling and persistence frameworks used for Linux tradecraft simulation.
Diamorphine requires Linux kernel module loading capability and therefore typically depends on prior root or equivalent high-privilege access. Its operational role is primarily stealth and privilege manipulation rather than initial compromise. Security teams most often encounter it as a post-compromise kernel implant used to hide follow-on malware and maintain attacker control over Linux hosts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The script installs the Diamorphine rootkit for stealth and root privileges... These files have been identified as the source code of a rootkit named Diamorphine... The rootkit source files are compiled to create a new kernel object diamorphine.ko, which is loaded as a kernel module through the insmod command.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
The signal SIGSUPER = 64 obtains root privileges by committing new credentials with uids = 0.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel rootkit discussed as using unusual kill signals and as detectable through kernel module loading telemetry such as finit_module/init_module syscall monitoring.
Linux LKM rootkit known for syscall-table hooking (e.g., getdents64/kill) and techniques to bypass symbol-hiding (e.g., using kprobes to locate kallsyms_lookup_name).
Referenced as a comparator LKM rootkit that compiles on the victim host, requiring local build tooling (e.g., gcc/make) and headers.
An open-source Linux kernel rootkit used by TeamTNT to hide mining processes on infected systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.