Stealthy Linux Malware PUMAKIT Escalates Privileges

Researchers at Elastic Security Labs discovered PUMAKIT, a Linux malware using stealth and unique privilege escalation to persist on infected systems.

PUMAKIT has a multi-stage setup, including a dropper, two memory executables, an LKM rootkit, and a userland rootkit.

Linux Malware PUMAKIT

The malware’s structure ensures it runs its payload only under specific conditions, staying stealthy and hard to detect.

Elastic Security Labs found a suspicious binary named cron during routine threat hunting on VirusTotal. The binary, uploaded on September 4, 2024, had zero detections, raising suspicions about its stealth and malicious intent.

Researchers found another related file, /memfd:wpn (deleted), uploaded the same day with no detections.

The binaries, both undetected, suggested a sophisticated malware operation. The dropper cron creates two memory executables: /memfd:tgt, a benign Cron binary, and /memfd:wpn, a rootkit loader that deploys the LKM rootkit based on system conditions.

The malware uses the rmdir() syscall for privilege escalation instead of the common kill() method, making it harder to detect and stop.

The PUMA LKM rootkit hooks 18 syscalls and several kernel functions using ftrace, enabling it to manipulate system behaviors such as hiding files and directories, evading detection, and blocking debugging tools.

A shared object file named Kitsune enhances the rootkit’s persistence and stealth capabilities, contributing to its overall functionality.

The malware also features a sophisticated command and control (C2) infrastructure, with researchers identifying multiple C2 servers facilitating communication.

Elastic Security Labs has created EQL/KQL rules and a YARA signature to detect and prevent PUMAKIT infections.

These methods target stages of the malware’s execution, including unusual file descriptor usage, suspicious commands via kthreadd, and privilege escalation using the rmdir command.

PUMAKIT’s advanced stealth, unique privilege escalation, and multi-architectural design pose a serious threat to Linux systems. Security teams should use these detection tools and stay vigilant against this evolving malware.

Elastic Security Labs will continue monitoring PUMAKIT to keep defenders updated on new variants or changes.

IOCs

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!