Linux rootkits explained – Part 2: Loadable kernel modules

Part two of Wiz's Linux rootkit series: how loadable kernel modules (LKMs) work, how threat actors like TeamTNT and Winnti abuse them in the wild, and how to detect kernel-space rootkits.