Rootkit

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.^[5][6]

APT41 deployed rootkits on Linux systems.^[7][8]

Carberp has used user mode rootkit techniques to remain hidden on the system.^[9]

Caterpillar WebShell has a module to use a rootkit on a system.^[10]

COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.^[11]

Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.^[12]

Ebury acts as a user land rootkit using the SSH service.^[13][14]

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.^[15]

HiddenWasp uses a rootkit to hook and implement functions on the system.^[16]

HIDEDRV is a rootkit that hides certain operating system artifacts.^[17]

Hikit is a Rootkit that has been used by Axiom.^{[18] [19]}

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().^[20]

HTRAN can install a rootkit to hide network connections from the host OS.^[21]

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.^[6]

PoisonIvy starts a rootkit from a malicious file dropped to disk.^[22]

Ramsay has included a rootkit to evade defenses.^[23]

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.^[24]

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.^[25]

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.^[26]

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.^{[27] [28]}

Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.^[29]

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.^[30][31]

WarzoneRAT can include a rootkit to hide processes, files, and startup.^[32]

Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.^[33]

Winnti Group used a rootkit to modify typical server functionality.^[34]

Zeroaccess is a kernel-mode rootkit.^[35]