Hunting Orbit Rootkit Part Open-Source Medusa Ransomware – IOC Deep Dive
OrBit: The Linux Rootkit That Hijacks the Dynamic Linker OrBit is a stealthy Linux userland rootkit that abuses the dynamic linker (ld.so) to load itself into every new process – hooking dozens of libc functions to hide files, processes and network sockets from standard tooling on the host.
- Rootkit
- Linux
Bottom line. Treat any confirmed OrBit detection as a full compromise of host integrity: the rootkit controls the standard C library on the machine, so on-host tools cannot be trusted. Isolate the system, capture memory and verify /etc/ld.so.preload from a clean out-of-band environment, then rebuild from a known-good image rather than cleaning in place.
Background
OrBit is a Linux userland rootkit first documented publicly by Intezer in July 2022. It is a repackaged, weaponized build of Medusa, an open-source LD_PRELOAD rootkit – which means the technique is well understood and widely available, lowering the bar for reuse.
LD_PRELOAD rootkits abuse a legitimate feature of the ld.so dynamic linker: a shared object listed for preloading is loaded automatically into every process the linker spawns. By inserting its own library ahead of the real ones, OrBit intercepts standard library calls before any legitimate code runs.
The result is comprehensive, host-wide stealth. OrBit hooks a large set of libc functions to hide its files, processes and network connections from administrators and security tooling, while hooking PAM to capture credentials – a design built for long-term, low-noise persistence on enterprise and cloud Linux systems.
What we observed
The analysed sample’s behaviour maps directly to OrBit’s documented tradecraft:
- Dynamic linker hijacking: modifies /etc/ld.so.preload (reported to point at a hidden malicious library such as /lib/libntpVnQE6mk/.l or /dev/shm/ldx/.l) so the rootkit’s shared object is loaded first into every new process.
- Telemetry blinding: hooks libc so diagnostic tools like ps, top, netstat, ss and lsof cannot see the rootkit’s processes, files or network sockets – on-host detection is effectively defeated.
- Credential harvesting: hooks PAM (Pluggable Authentication Modules) to silently capture SSH and sudo usernames and passwords, storing them in hidden directories (e.g. /lib/libseconf/).
- Covert remote access: maintains encrypted, out-of-band reverse-shell / C2 access, blending beaconing into normal traffic to resist inspection.
OrBit infection lifecycle
Once the linker is hijacked, every command on the host silently runs the rootkit’s hooks first.
Attribution
OrBit is a weaponized derivative of the open-source Medusa LD_PRELOAD rootkit rather than the tooling of a single named actor; the malware lineage is well established, but specific campaigns are operated by varied intruders. The behavioural correlation to OrBit in this sample is high-confidence, but any operator attribution should rely on infrastructure and telemetry rather than the family name alone.
Confidence: 92%.
When the rootkit owns the C library, the compromised host stops being a reliable witness – it will only report what the attacker allows.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Persistence | Hijack Execution Flow: Dynamic Linker Hijacking | T1574.006 | Modifies /etc/ld.so.preload so a malicious shared object is preloaded into every new process. |
| Defense Evasion | Rootkit | T1014 | Hooks libc to hide its files, processes and network sockets from standard tooling on the host. |
| Defense Evasion | Impair Defenses: Disable or Modify Tools | T1562.001 | Intercepts output of ps, top, netstat, ss and lsof to conceal malicious artifacts from defenders. |
| Credential Access | Modify Authentication Process: Pluggable Authentication Modules | T1556.003 | Hooks PAM to log SSH and sudo credentials inline and store them in hidden directories. |
| Command and Control | Application Layer Protocol: Web Protocols | T1071.001 | Maintains covert, encrypted remote access with low-frequency beaconing over standard protocols. |
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
| 40b5127c8cf9d6bec4dbeb61ba766a95c7b2d0cafafcb82ede5a3a679a3e3020 | sha256 | Analysed sample correlated to OrBit by behaviour |
Detection
Copy-ready hunting query:
# Sentinel / Defender for Endpoint (KQL): writes to the dynamic-linker preload config
DeviceFileEvents
| where FolderPath in~ ("/etc/ld.so.preload", "/etc/ld.so.conf")
| where ActionType in~ ("FileCreated", "FileModified")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessCommandLine, RequestAccountName
# Host hunt (run from a clean/out-of-band context): inspect preload + known OrBit paths
cat /etc/ld.so.preload 2>/dev/null
ls -la /lib/libntpVnQE6mk/ /dev/shm/ldx/ /lib/libseconf/ 2>/dev/null
# Hidden-socket check: compare kernel-truth vs on-host tooling for discrepancies
# (run ss/netstat and compare against out-of-band netflow; deltas may indicate hooked libc)Recommendations
- Isolate affected hosts and capture volatile memory before shutdown; because libc is hooked, do not trust native on-host tools – use statically linked binaries from trusted media or out-of-band forensics.
- Verify /etc/ld.so.preload and the dynamic-loader configuration from a clean live/recovery environment; treat any unexpected preloaded library or hidden paths (e.g. /lib/libntpVnQE6mk, /dev/shm/ldx, /lib/libseconf) as confirmation of compromise.
- Do not remediate in place – rebuild affected systems from hard-vetted golden images, and rotate all SSH keys and credentials that may have been captured via the PAM hooks.
- Deploy file-integrity monitoring on the linker configuration and system libraries, alert on writes to ld.so.preload, and correlate out-of-band netflow against on-host socket listings to surface hidden connections.
