Skip to content

Linux

OrBit (Re)turns: Tracking an Open-Source Linux Rootkit Across Four Years of Forks and Deployments

May 14, 2026

Fire in the Woods – A New Variant of FireWood

August 13, 2025

Detection Rules for Lightning Framework (and How to Make Them With Osquery)

August 3, 2022

Lightning Framework: New Undetected "Swiss Army Knife" Linux Malware ⚡

July 21, 2022

OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow

July 6, 2022

Symbiote: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat

June 22, 2022

New SysJoker Backdoor Targets Windows, Linux, and macOS

January 11, 2022

Conducting Digital Forensics Incident Response (DFIR) on an Infected GitLab Server

November 4, 2021

Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike

September 13, 2021

HabitsRAT Used to Target Linux and Windows Servers

April 20, 2021

Rocke Group Actively Targeting the Cloud: Wants Your SSH Keys

April 6, 2021

Early Bird Catches the Worm: New Golang Worm Drops XMRig Miner on Servers

December 29, 2020

Stantinko's Proxy After Your Apache Server

November 24, 2020

A Storm is Brewing: IPStorm Now Has Linux Malware

October 1, 2020

Watch Your Containers: Doki Infecting Docker Servers in the Cloud

July 28, 2020

Kaiji: New Chinese Linux malware turning to Golang

May 4, 2020

Fantastic payloads and where we find them

March 30, 2020

Linux Rekoobe Operating with New, Undetected Malware Samples

January 20, 2020

ACBackdoor: Analysis of a New Multiplatform Backdoor

November 18, 2019

PureLocker: New Ransomware-as-a-Service Being Used in Targeted Attacks Against Servers

November 12, 2019

How We Seized 15 Active Ransomware Campaigns Targeting Linux File Storage Servers

July 10, 2019

HiddenWasp Malware Stings Targeted Linux Systems

May 29, 2019

Technical Analysis: Pacha Group Competing against Rocke Group for Cryptocurrency Mining Foothold on the Cloud

May 9, 2019

Technical Analysis: Pacha Group Deploying Undetected Cryptojacking Campaigns on Linux Servers

February 28, 2019

ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups

January 7, 2019

Muhstik Botnet Reloaded: New Variants Targeting phpMyAdmin Servers

November 12, 2018

"EternalMiner" Copycats exploiting SambaCry for cryptocurrency mining

July 26, 2017