Loading malware…
libprocesshider is a Linux userland rootkit-style shared library used to conceal selected processes from common system utilities by abusing the dynamic linker preload mechanism. It is compiled as a shared object and loaded through the LD_PRELOAD facility, typically by modifying the system preload configuration so the library is injected into processes that enumerate running tasks. Rather than altering the kernel, it hooks libc directory-reading functions such as readdir and readdir64 and filters entries from the /proc filesystem, causing targeted process names to be omitted from tools that rely on procfs traversal, including standard process and socket inspection utilities.
The implementation resolves the original libc functions dynamically and inspects directory enumeration requests against /proc, then reads process metadata to determine whether a given PID corresponds to the configured process name. Matching entries are skipped, providing stealth for userland payloads such as miners or bot processes. This behavior is consistent with rootkit-like defense evasion on Linux systems.
libprocesshider has been used operationally by multiple threat actors and malware campaigns as an auxiliary stealth component rather than as a standalone intrusion platform. Public reporting has linked its use to TeamTNT, which employed it to hide malicious Linux processes including Tsunami bot activity on compromised hosts, and to the Xanthe cryptomining botnet, which installed it to conceal its XMRig-derived miner. It has also been observed among tooling associated with Sandworm-linked activity in Ukrainian critical infrastructure environments. Its role across these intrusions is primarily process concealment and post-compromise defense evasion on Linux servers, cloud workloads, containers, and other Unix-like environments where procfs-based process inspection is common.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
AT&T Alien Labs released a report on TeamTNT’s use of libprocesshider . The tool is used to hide processes using LD_PRELOAD . ... TeamTNT used libprocesshider to hide their Tsunami bot on infected machines.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Every process with this name will be excluded ... static const char* process_to_filter = "evil_script.py"; ... if(get_dir_name(dirp, dir_name, sizeof(dir_name)) && strcmp(dir_name, "/proc") == 0 && get_process_name(dir->d_name, process_name) && strcmp(process_name, process_to_filter) == 0) { continue; }
Every process with this name will be excluded ... strcmp(process_name, process_to_filter) == 0) { continue; }
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A userland process-hiding tool abused by TeamTNT via LD_PRELOAD to conceal malicious processes such as Tsunami.
A Linux rootkit used here in modified form as part of the attacker toolset to hide processes on infected systems.
A malicious shared-object rootkit used by Xanthe to hide the miner process by overriding process-enumeration behavior via /etc/ld.so.preload and readdir hooking.
Userland process-hiding tool (LD_PRELOAD-based) used to conceal malicious processes (e.g., miners) on Linux systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.