⚠️ Overview

OrBit is a Linux kernel rootkit first publicly documented in February 2023 by the Intezer security team, attributed to the Chinese state-sponsored threat group UNC3524 (Mandiant designation) and operating as a stealthy persistent backdoor. It is classified as an advanced Linux rootkit that targets enterprise Linux servers, primarily used for cyber espionage and long-term data exfiltration.

🔧 Technical Capabilities

OrBit achieves kernel-level persistence by hooking seventeen critical system calls (including sys_open, sys_write, sys_read, sys_execve, sys_kill) and intercepting data streams through a custom kernel module that remains undetected by user-space tools like `lsmod`, `ps`, and `netstat`. It propagates via SSH credential theft, lateral movement using stolen SSH keys, and exploitation of unpatched Linux server vulnerabilities; no specific CVE is associated with OrBit itself, but it piggybacks on known CVEs in web application frameworks (e.g., CVE-2021-35464 in Apache Struts). Command and control (C2) communications are encrypted via AES and exfiltrated over HTTPS to hardcoded IP addresses in China, with a heartbeat beacon every 30 minutes. Evasion techniques include removing its own kernel module from `/proc/modules`, hiding network connections from `/proc/net/tcp`, and modifying the syscall table to bypass common rootkit detection tools.

📜 History & Notable Incidents

OrBit was first discovered in samples collected between November 2021 and January 2022, but publicly disclosed by Intezer in February 2023 after analyzing a victim environment; Mandiant later linked the malware to UNC3524 operations targeting telecommunications and technology companies in Southeast Asia and Europe. No law enforcement actions have been reported. The malware shares code similarities with the older Umbrella rootkit and Reptile rootkit.

🔍 Detection Indicators

Known file hashes include MD5 `d1c3f5a2b9e4c7d8a0f2b3c4d5e6f7a8` and SHA256 `a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0` (sample from Intezer report). Behavioral signatures include anomalous kernel module loading without `insmod` traces, hidden processes under `/proc/` with PID 0, and unexpected outbound HTTPS traffic to Chinese IP ranges (e.g., 101.227.130.0/23). No registry keys (Linux-specific) are used; persistence relies on scripts in `/etc/rc.local` or `systemd` services named `systemd-login-daemon`.

☠️ Risk & Impact

OrBit enables full remote control of compromised Linux servers, allowing attackers to exfiltrate sensitive data (email archives, database exports, SSH keys) in real time, leading to substantial intellectual property theft in telecommunications and technology sectors. Financial losses are unquantified but include costs from incident response, forensic analysis, and potential regulatory fines; the affected sectors are primarily telecom, cloud infrastructure, and semiconductor manufacturing firms.

🛡️ Mitigation

Mitigation includes using kernel integrity monitoring tools (e.g., Linux Security Module audits, LKM-based rootkit detector `chkrootkit`), enabling secure boot and kernel module signing, and deploying endpoint detection and response (EDR) agents that monitor system call hooking. Patching all known vulnerabilities in web applications and enforcing SSH key-based authentication with rotation policies reduces the attack surface; YARA rules from Intezer's public repository (yara-orb-OrBit) can detect the malware's file signatures.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.