Symbiote, New Linux Malware Practically Impossible To Detect | Cyber Crime & Malware News Updates

Опубликовано: 02 Март 2026
на канале: CSI digital

145

Symbiote, a novel Linux threat, was discovered by security companies BlackBerry and Intezer in a joint investigation.
The term "symbiote" refers to the organisms that coexist with any other organism in a mutually beneficial relationship, just as this threat does to the infected devices. Because of this, security researchers have described this vulnerability as near-impossible to spot.
In contrast to other Linux attacks, Symbiote requires the infection of other operating processes in order to do harm to affected machine90s. SO (Shared object) libraries are loaded across all running operations using LD_PRELOAD and infiltrate the machine, resembling a parasite. As the virus threat has affected all active processes, it offers the malicious user rootkit capabilities as well as facilitates data-stealing capabilities.
Symbiote is the very first Linux virus to use the BPF (Berkeley Packet Filter) hooking mechanism to mask malicious network activity, according to experts.
Using the LD_PRELOAD command, Symbiote could be loaded before any of the shared objects, enabling it to "hijack the imports" from any other library files downloaded for the program. The Symbiote masks its existence by hooking libpcap and libc routines.

#Linux #Malware #Symbiote