PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Linux rootkits explained – Part 2: Loadable kernel modules

wiz.io | blog | #cloud-security | #malware | #linux | #detection | #rootkit | #threat-research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of Wiz's Linux rootkit series: how loadable kernel modules (LKMs) work, how threat actors like TeamTNT and Winnti abuse them in the wild, and how to detect kernel-space rootkits.
Published
Collected

Related coverage

incident · netspi.com
Ransomware Prevention, Detection, and Simulation
An overview of ransomware as a criminal business model, tracing its economic lifecycle from ransom payments to RaaS toolkits, with guidance on prevention, detection, and attack simulation readiness.
research · volexity.com
Using Memory Analysis to Detect EDR-Nullifying Malware
In the ever-changing cybersecurity landscape, threat actors are forced to evolve and continually modify the tactics, techniques, and procedures (TTPs) they employ to launch and sustain attacks successfully. They are […]
blog · wiz.io
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense
Wiz's contribution to the 2026 Verizon DBIR: exploitation is now the top initial access vector (31% of breaches) and only 26% of known exploited vulnerabilities were remediated.
blog · wiz.io
Cloud Threats Retrospective 2026: What AI Changed (and What It Didn’t)
Wiz's Cloud Threats Retrospective: 80% of 2025 intrusions began with known weaknesses — vulnerabilities, exposed secrets, misconfigurations — while AI expanded the surface and sped up attackers.
blog · wiz.io
Introducing HoneyBee: How We Automate Honeypot Deployment for Threat Research
Wiz introduces HoneyBee, an open-source tool that auto-generates intentionally misconfigured Docker deployments, with Nuclei validation templates, so researchers can deploy realistic honeypots safely.
blog · wiz.io
The emerging use of malware invoking AI
Wiz reviews malware that invokes AI directly — LameHug's HuggingFace recon prompts, the Amazon Q extension compromise, s1ngularity's AI-CLI abuse and PromptLock — moving prompts into payloads.
Back