Rootkit

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.^[5][6]

APT41 deployed rootkits on Linux systems.^[7][8]

ArcaneDoor included hooking the processHostScanReply() function on victim Cisco ASA devices.^[9]

Carberp has used user mode rootkit techniques to remain hidden on the system.^[10]

Caterpillar WebShell has a module to use a rootkit on a system.^[11]

COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.^[12]

Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.^[13]

Ebury acts as a user land rootkit using the SSH service.^[14][15]

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.^[16]

HiddenWasp uses a rootkit to hook and implement functions on the system.^[17]

HIDEDRV is a rootkit that hides certain operating system artifacts.^[18]

Hikit is a Rootkit that has been used by Axiom.^{[19] [20]}

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().^[21]

HTRAN can install a rootkit to hide network connections from the host OS.^[22]

Line Dancer can hook both the crash dump process and the Autehntication, Authorization, and Accounting (AAA) functions on compromised machines to evade forensic analysis and authentication mechanisms.^[9]

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.^[6]

MEDUSA is a rootkit with command execution and credential logging capabilities.^[23]

PoisonIvy starts a rootkit from a malicious file dropped to disk.^[24]

Ramsay has included a rootkit to evade defenses.^[25]

During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.^[26]

REPTILE has the ability to hook kernel functions and modify functions data to achieve rootkit functionality such as hiding processes and network connections.^[23]

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.^[27]

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.^[28]

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.^[29]

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.^{[30] [31]}

Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.^[32]

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.^[23]

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.^[33][34]

WarzoneRAT can include a rootkit to hide processes, files, and startup.^[35]

Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.^[36]

Winnti Group used a rootkit to modify typical server functionality.^[37]

Zeroaccess is a kernel-mode rootkit.^[38]