Researchers discovered PUMAKIT, a Linux rootkit capable of hiding files, escalating privileges, and evading system tools and detection.—————————————————————————————————————————————Elastic Security Lab researchers discovered a new loadable kernel module (LKM) rootkit called PUMAKIT that supports advanced evasion mechanisms.PUMAKIT features a multi-stage design including a dropper, memory-resident executables, and a rootkit. It leverages an LKM rootkit named ‘PUMA,’ using ftrace hooks to modify core system functions.The malware hooks 18 syscalls and several kernel functions using `ftrace()` to hide files, directories, and the rootkit itself, while evading debugging attempts.Developers focused on stealthy deployment, the malware activates only under specific conditions, such as secure boot checks or kernel symbol availability, embedding ELF binaries within its dropper.*’PUMAKIT is a sophisticated piece of malware, initially uncovered during routine threat hunting on VirusTotal and named after developer-embedded strings found within its binary.’ reads the [report](https://www.elastic.co/security-labs/declawing-pumakit) published by Elastic Security Lab. ‘Key functionalities of the kernel module include privilege escalation, hiding files and directories, concealing itself from system tools, anti-debugging measures, and establishing communication with command-and-control (C2) servers.’*The LKM rootkit uses the syscall table to manipulate system behavior and relies on kallsyms_lookup_name() for symbol resolution. Unlike rootkits that target kernel versions 5.7 and above, the rootkit component of PUMAKIT does not use `kprobes`, suggesting it is designed for older kernels.*’This choice is significant because, prior to kernel version 5.7, `kallsyms_lookup_name()` was exported and could be easily leveraged by modules, even those without proper licensing.’ continues the report.**’In February 2020, kernel developers debated the unexporting of `kallsyms_lookup_name()` to prevent misuse by unauthorized or malicious modules. A common tactic involved adding a fake `MODULE_LICENSE(‘GPL’)` declaration to circumvent licensing checks, allowing these modules to access non-exported kernel functions. The LKM rootkit demonstrates this behavior’*The `rmdir_hook()` function in PUMAKIT’s kernel module intercepts `rmdir()` syscalls to manipulate directory operations. The malware uses it for privilege escalation and to retrieve configuration details based on a structured input pattern. The hook processes commands and arguments embedded in the syscall, starting with ‘zarya,’ followed by command and argument characters. This structured system enhances control and concealment.Below is the list of commands processed by the hook:Command Purpose `zarya.c.0` Retrieve the config `zarya.t.0` Test the working `zarya.k.` Hide a PID `zarya.v.0` Get the running versionElastic Security developed a [YARA](https://github.com/elastic/protections-artifacts/blob/main/yara/rules/Linux_Rootkit_Pumakit.yar) signature to detect PUMAKIT components, including the dropper (`cron`), rootkit loader (`/memfd:wpn`), LKM rootkit, and Kitsune shared object files.’PUMAKIT is a complex and stealthy threat that uses advanced techniques like syscall hooking, memory-resident execution, and unique privilege escalation methods. Its multi-architectural design highlights the growing sophistication of malware targeting Linux systems,’ concludes the report.Follow me on Twitter: [**@securityaffairs**](https://twitter.com/securityaffairs) and [**Facebook**](https://www.facebook.com/sec.affairs) and [Mastodon](https://infosec.exchange/@securityaffairs)[**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**(** [**SecurityAffairs**](http://securityaffairs.co/wordpress/)**–** **hacking, malware)**
Related Tags:
NAICS: 335 – Electrical Equipment
Appliance
Component Manufacturing
NAICS: 519 – Web Search Portals
Libraries
Archives
Other Information Services
NAICS: 541 – Professional
Scientific
Technical Services
NAICS: 33 – Manufacturing – Metal
Electronics And Other
NAICS: 51 – Information
Blog: Security Affairs
TA0004 – Privilege Escalation
Input Capture: Keylogging
Input Capture
Associated Indicators: