Malware
PUMAKIT
aka PUMA · Kitsune
According to Elastic, PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control
PUMAKIT, also known as PUMA, Kitsune, is a Linux malware family.
Background
Elastic describes PUMAKIT as an advanced loadable kernel module (LKM) rootkit that uses sophisticated stealth techniques to conceal itself and keep in touch with command-and-control servers.
The rootkit portion, which the authors call “PUMA", leans on the Linux ftrace function tracer to hook 18 separate syscalls plus several kernel functions, letting it alter fundamental system behavior. Interaction with PUMA happens through unusual channels, such as abusing the rmdir() syscall to escalate privileges and using dedicated commands to pull configuration and runtime details.
The module's main capabilities are privilege escalation, hiding files and directories, masking itself from system utilities, anti-debugging defenses, and reaching out to its command-and-control (C2) servers.
It is paired with a userland shared-object rootkit that the authors internally call Kitsune.
Source: Malpedia (Fraunhofer FKIE).