Wiz publishes guide on Linux kernel rootkits

Wiz has published the second part of its series on Linux rootkits, focusing on loadable kernel modules (LKMs) and their abuse in kernel-space attacks. The article explains how LKMs work, how attackers hook kernel functions, and how to detect such rootkits.

It cites real-world usage by threat actors including TeamTNT, which used the Diamorphine rootkit to hide cryptomining processes, and the Winnti group (APT 41), which employed adore-ng and suterusu rootkits. The piece also outlines constraints for attackers, such as the need for root privileges or the SYS_MODULE capability, and the requirement to compile modules for specific kernel versions.