🛡 Detect Medusa Rootkit on Linux – Test Guide
A new stealth rootkit called Medusa uses LD_PRELOAD to hijack dynamic libraries and hide files, processes, and ports from commands like ls, ps, and netstat.
Goal: Catch Medusa by bypassing its tricks.
⸻
How to Detect It (Step-by-Step)
1. Use statically built BusyBox – it doesn’t rely on dynamic libraries, so it ignores LD_PRELOAD.
2. Launch a clean shell:
3. Run commands inside it:
4. Compare output with normal shell.
If you see hidden files/processes appear in BusyBox but not in bash → You’re likely infected.
⸻
🔴 Don’t install BusyBox via apt on a live compromised system.
Instead:
• Run it from a USB or RAM (/dev/shm) to avoid overwriting evidence.
references:
github
blog
#Rootkit
@GoSecurity
A new stealth rootkit called Medusa uses LD_PRELOAD to hijack dynamic libraries and hide files, processes, and ports from commands like ls, ps, and netstat.
Goal: Catch Medusa by bypassing its tricks.
⸻
How to Detect It (Step-by-Step)
1. Use statically built BusyBox – it doesn’t rely on dynamic libraries, so it ignores LD_PRELOAD.
2. Launch a clean shell:
busybox ash
3. Run commands inside it:
ls -la /lib
ps aux
netstat -tulpn
4. Compare output with normal shell.
If you see hidden files/processes appear in BusyBox but not in bash → You’re likely infected.
⸻
🔴 Don’t install BusyBox via apt on a live compromised system.
Instead:
• Run it from a USB or RAM (/dev/shm) to avoid overwriting evidence.
references:
github
blog
#Rootkit
@GoSecurity
The OWASP Smart Contract Top 10 (2025) is a standard awareness document providing Web3 developers and security teams with insights into the top 10 vulnerabilities found in smart contracts.
https://owasp.org/www-project-smart-contract-top-10/
https://owasp.org/www-project-smart-contract-top-10/
Researchers cracked the encryption used by DarkBit ransomware
https://securityaffairs.com/181064/malware/researchers-cracked-the-encryption-used-by-darkbit-ransomware.html
https://securityaffairs.com/181064/malware/researchers-cracked-the-encryption-used-by-darkbit-ransomware.html
Security Affairs
Researchers cracked the encryption used by DarkBit ransomware
Researchers at cybersecurity firm Profero cracked DarkBit ransomware encryption, allowing victims to recover files for free.
Researcher earns Google Chrome ’s top $250K for a sandbox escape vulnerability enabling remote code execution.
https://securityaffairs.com/181057/hacking/chrome-sandbox-escape-nets-security-researcher-250000-reward.html
https://securityaffairs.com/181057/hacking/chrome-sandbox-escape-nets-security-researcher-250000-reward.html
Security Affairs
Chrome sandbox escape nets security researcher $250,000 reward
Researcher earns Google Chrome’s top $250K bounty for a sandbox escape vulnerability enabling remote code execution.
Offensive Security
Check CVE-2024-6387 https://github.com/xaitax/CVE-2024-6387_Check
The provided exploit code is optimized only for the i386 (32-bit) architecture.
https://github.com/zgzhang/cve-2024-6387-poc
https://github.com/zgzhang/cve-2024-6387-poc
Lesser Known Linux Persistence Mechanisms
John Hammond
https://youtu.be/whhOYRWd_rs?si=ThofWaLJoEauQkfH
John Hammond
https://youtu.be/whhOYRWd_rs?si=ThofWaLJoEauQkfH
YouTube
Lesser Known Linux Persistence Mechanisms
Learn Cybersecurity and more with Just Hacking Training: https://jh.live/training
See what else I'm up to with: https://jh.live/newsletter
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: h…
See what else I'm up to with: https://jh.live/newsletter
ℹ️ Affiliates:
Learn how to code with CodeCrafters: https://jh.live/codecrafters
Host your own VPN with OpenVPN: h…
SERVER-SIDE TEMPLATE INJECTION:
https://research.checkpoint.com/2024/server-side-template-injection-transforming-web-applications-from-assets-to-liabilities/
https://research.checkpoint.com/2024/server-side-template-injection-transforming-web-applications-from-assets-to-liabilities/
Check Point Research
Server-Side Template Injection: Transforming Web Applications from Assets to Liabilities - Check Point Research
Executive Summary Research by Erez Goldberg Server-Side Template Injection (SSTI) vulnerabilities refer to weaknesses in web applications which attackers can exploit to inject malicious code into server-side templates. This allows them to execute arbitrary…