OrBit Rootkit Targets Linux to Steal SSH and Sudo Credentials

Hackers are continuing to abuse a stealthy Linux rootkit known as OrBit to harvest SSH and sudo credentials, with new research showing the threat has quietly evolved over four years while remaining active in the wild.

First analyzed in 2022, OrBit was initially believed to be a custom-built Linux userland rootkit. It operates by hijacking the system’s dynamic linker (ld.so), ensuring a malicious shared library is loaded into every running process.

This allows attackers to intercept authentication flows, capture credentials, and hide their presence from administrators.

According to intezer report, reveals that OrBit is not a unique creation. Instead, it is a repackaged version of Medusa, an open-source LD_PRELOAD rootkit published on GitHub in late 2022.

Rather than developing new malware, threat actors have been modifying and redeploying this publicly available codebase with different configurations, credentials, and stealth techniques.

Once deployed, OrBit acts as a passive implant. It does not rely on traditional command-and-control communication. Instead, attackers access compromised systems through a hidden SSH backdoor.

Meanwhile, the rootkit hooks into Pluggable Authentication Modules (PAM) to silently capture usernames and passwords from SSH logins and sudo activity storing them locally in hidden directories such as /lib/libseconf/.

OrBit Rootkit Targets Linux

The malware’s stealth capabilities are particularly advanced. By hooking more than 40 libc functions, OrBit can hide files, processes, and network connections, effectively making infected systems appear clean even under inspection.

Researchers tracking samples from 2022 to 2026 identified two main variants. The first, called Lineage A, is a full-featured build that includes credential harvesting, network hiding, packet capture, and backdoor access.

The second, Lineage B, is a lighter version that removes several capabilities, likely to reduce its footprint and avoid detection. Notably, Lineage B samples often lack embedded passwords, suggesting alternative authentication methods.

Over time, attackers have not significantly changed the core code. Instead, they have rotated credentials, modified installation paths, and adjusted features.

For example, newer variants introduced compatibility fixes like a custom “xread” function to prevent system instability that could reveal the rootkit.

Later versions also added audit log evasion and, in 2025, a more advanced PAM hook that allows attackers to manipulate authentication outcomes, not just observe them.

A major shift occurred in 2025 when operators introduced a multi-stage infection chain. This included a dropper and an infector capable of spreading the malware across systems and establishing persistence via cron jobs.

Unlike earlier versions, this variant introduced limited external communication by downloading payloads from a remote domain, marking the first time OrBit showed command-and-control-like behavior.

Infrastructure linked to this campaign overlaps with older malware activity, including the RHOMBUS botnet, though attribution remains uncertain.

At the same time, multiple threat groups have been observed using OrBit, including the ransomware-linked BLOCKADE SPIDER and the state-backed UNC3886 espionage group.

This widespread adoption highlights a key shift in the threat landscape. OrBit is no longer tied to a single actor but has become a shared toolkit used by multiple groups for persistence and credential theft across Linux environments, including critical infrastructure and virtualized systems.

Security experts warn that defenders should focus less on attributing attacks to a specific group and more on detecting the underlying behaviors of the Medusa-based rootkit.

Its consistent build patterns, hidden filesystem artifacts, and credential harvesting techniques remain reliable indicators of compromise, even as attackers continue to modify superficial elements like paths and passwords.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.