---
id: 7246
title: "Linux rootkits explained – Part 2: Loadable kernel modules"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/linux-rootkits-explained-part-2-loadable-kernel-modules"
published_at: "2023-10-24T17:52:29Z"
tags: ["cloud-security", "malware", "linux", "detection", "rootkit", "threat-research"]
phying_url: "https://phying.com/item/7246"
lang: en
---

# Linux rootkits explained – Part 2: Loadable kernel modules

## Summary

Part two of Wiz's Linux rootkit series: how loadable kernel modules (LKMs) work, how threat actors like TeamTNT and Winnti abuse them in the wild, and how to detect kernel-space rootkits.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2023-10-24T17:52:29Z
- **Original:** https://www.wiz.io/blog/linux-rootkits-explained-part-2-loadable-kernel-modules
- **Phying News:** https://phying.com/item/7246