Pierluigi Paganini
December 15, 2024
Elastic Security Lab researchers discovered a new loadable kernel module (LKM) rootkit called PUMAKIT that supports advanced evasion mechanisms.
PUMAKIT features a multi-stage design including a dropper, memory-resident executables, and a rootkit. It leverages an LKM rootkit named “PUMA,” using ftrace hooks to modify core system functions.
The malware hooks 18 syscalls and several kernel functions using ftrace() to hide files, directories, and the rootkit itself, while evading debugging attempts.
Developers focused on stealthy deployment, the malware activates only under specific conditions, such as secure boot checks or kernel symbol availability, embedding ELF binaries within its dropper.
“PUMAKIT is a sophisticated piece of malware, initially uncovered during routine threat hunting on VirusTotal and named after developer-embedded strings found within its binary.” reads the report published by Elastic Security Lab. “Key functionalities of the kernel module include privilege escalation, hiding files and directories, concealing itself from system tools, anti-debugging measures, and establishing communication with command-and-control (C2) servers.”
The LKM rootkit uses the syscall table to manipulate system behavior and relies on kallsyms_lookup_name() for symbol resolution. Unlike rootkits that target kernel versions 5.7 and above, the rootkit component of PUMAKIT does not use kprobes, suggesting it is designed for older kernels.
“This choice is significant because, prior to kernel version 5.7, kallsyms_lookup_name() was exported and could be easily leveraged by modules, even those without proper licensing.” continues the report.
“In February 2020, kernel developers debated the unexporting of kallsyms_lookup_name() to prevent misuse by unauthorized or malicious modules. A common tactic involved adding a fake MODULE_LICENSE("GPL") declaration to circumvent licensing checks, allowing these modules to access non-exported kernel functions. The LKM rootkit demonstrates this behavior”
The rmdir_hook() function in PUMAKIT’s kernel module intercepts rmdir() syscalls to manipulate directory operations. The malware uses it for privilege escalation and to retrieve configuration details based on a structured input pattern. The hook processes commands and arguments embedded in the syscall, starting with “zarya,” followed by command and argument characters. This structured system enhances control and concealment.
Below is the list of commands processed by the hook:
| Command | Purpose |
|---|---|
zarya.c.0 | Retrieve the config |
zarya.t.0 | Test the working |
zarya.k.<pid> | Hide a PID |
zarya.v.0 | Get the running version |
Elastic Security developed a YARA signature to detect PUMAKIT components, including the dropper (cron), rootkit loader (/memfd:wpn), LKM rootkit, and Kitsune shared object files.
“PUMAKIT is a complex and stealthy threat that uses advanced techniques like syscall hooking, memory-resident execution, and unique privilege escalation methods. Its multi-architectural design highlights the growing sophistication of malware targeting Linux systems,” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)
