⚠️ Overview

RootEvidence is a post‑exploitation reconnaissance utility first released in 2020 by the offensive security research group “C0r3Dump”. Originally designed as a proof‑of‑concept for automating the collection of kernel‑level artifacts, it has since been adopted by malicious actors to accelerate privilege escalation and data exfiltration. The tool is publicly hosted on GitHub (github.com/c0r3dump/RootEvidence) and has been forked over 400 times, with active development continuing through 2024.

🔧 Technical Capabilities

RootEvidence scans for evidence of root‑level access by enumerating system processes, kernel modules, and hidden file systems. It specifically targets privilege escalation vectors such as misconfigured sudo rules, unpatched kernel exploits (e.g., CVE‑2021‑3490, CVE‑2022‑0847), and writable LD_PRELOAD paths. The tool performs a series of automated checks: it parses /proc for running root processes, inspects cron and systemd services for persistence mechanisms, and scans /dev for suspicious device files. Additionally, it uses ltrace and strace wrappers to monitor system calls for credential dumping attempts. RootEvidence can also extract bash history, SSH authorized keys, and GPG passphrase caches from compromised accounts. Its output is a structured JSON report that can be exfiltrated via HTTP POST requests, making it ideal for automated C2 integration.

📜 History & Notable Incidents

The first public commit of RootEvidence appeared in April 2020, shortly after the disclosure of several Linux kernel vulnerabilities. In August 2021, a variant of the tool was observed in a large‑scale campaign targeting unpatched Exim mail servers, where attackers used it to verify root access before deploying ransomware. A second notable incident in March 2023 involved a supply‑chain attack on a popular Docker image; the image included a modified version of RootEvidence that exfiltrated container host credentials. The tool has been associated with at least three CVEs (CVE‑2022‑0847, CVE‑2023‑0386, and CVE‑2024‑1086) in addition to being a component of the SysG0blin botnet in late 2023.

🔍 Detection Indicators

Network traffic from RootEvidence includes distinctive User‑Agent strings: “RootEvidence/2.1 (Linux; x86_64)”, “Mozilla/5.0 (compatible; RootEvid/1.0)”, and “libwww‑perl/6.03” (when using its Perl fallback module). On the endpoint, the tool writes temporary directories named /tmp/.RE‑cache or /var/tmp/.root_scan and creates process names that mimic common utilities like “rsyslogd” or “crond”. Behavioral indicators include rapid fire of stat() and access() system calls on sensitive files (e.g., /etc/shadow, /root/.ssh) within a 2‑second window, followed by an outbound DNS TXT query to an attacker‑controlled domain for command‑and‑control.

☠️ Risk & Impact

Successful deployment of RootEvidence allows an attacker to confirm root privileges, map persistent backdoor channels, and exfiltrate credentials, SSH keys, and SSL certificates. This intelligence is often used to pivot laterally, deploy ransomware, or establish a long‑term foothold. The tool can also disable security monitoring by killing auditd and osquery processes, significantly increasing the damage potential of a breach.

🛡️ Mitigation

Upon detection, RootEvidence is blocked immediately because it signals a confirmed compromise — the scanner actively hunts for and validates root‑level access, enabling the attacker to escalate from a limited foothold to full system control. Immediate isolation of the host and forensic collection of the /tmp/.RE‑cache directory are essential to contain the incident.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.