TF-MAL-elf.reptile

Description

ThreatFox malware family `elf.reptile`. Printable name: reptile.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Reptile Malware Targeting Linux Systems - ASEC
  web:asec.ahnlab.com

  Reptile is an open-source kernel module rootkit that targets Linux systems and is publicly available on GitHub. [1] Rootkits are malware that possess the capability to conceal themselves or other malware . They primarily target files, processes, and network communications for their concealment. Reptile's concealment capabilities include not only its own kernel module but also files ...

  2026-05-22 05:23 UTC
• REPTILE, Software S1219 | MITRE ATT&CK®
  web:attack.mitre.org

  REPTILE is an open-source Linux rootkit with multiple components that provides backdoor access and functionality. [1]

  2026-05-22 05:23 UTC
• Analysis of Reptile: the sophisticated rootkit that threatens Linux systems
  web:cyberpills.news

  Prevention and mitigation : defend against Reptile Given the broad threat posed by Reptile , IT industry experts recommend a number of preventative measures. Making users aware of online safety practices, updating the operating system regularly, and using sophisticated anti- malware tools are of paramount importance.

  2026-05-22 05:23 UTC
• New Reptile Rootkit Malware Attacking Linux Systems
  web:cybersecuritynews.com

  The cybersecurity researchers at ASEC recently identified this new rootkit malware . Rootkit Malware Attacking Linux Systems Reptile aids malware installation and equips attackers with Listener, a command line tool that awaits a reverse shell connection to execute on infected systems, granting control to the attacker.

  2026-05-22 05:23 UTC
• reptile (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the reptile malware family including references, samples and yara signatures.

  2026-05-22 05:23 UTC
• Reptile Rootkit and its mitigation strategies - Positka
  web:positka.com

  The Reptile rootkit's emergence poses a considerable hazard to Linux systems, particularly within the South Korean landscape. Distinguished by its reverse shell proficiency and strategic employment of Port Knocking, its capacity to evade detection through magic packet-based triggers underscores its covert nature.

  2026-05-22 05:23 UTC
• Reptile Rootkit employed in attacks against Linux systems in South Korea
  web:securityaffairs.com

  Researchers observed threat actors that are using an open-source rootkit called Reptile in attacks aimed at systems in South Korea. Reptile is an open-source kernel module rootkit that was designed to target Linux systems, unlike other rootkits, it also offers a reverse shell. The malware supports port knocking, it opens a specific port on an infected system and waits for a Magic Packet sent ...

  2026-05-22 05:23 UTC
• Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems
  web:thehackernews.com

  Threat actors are using an open-source rootkit called Reptile to target Linux systems in South Korea. "Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of systems ...

  2026-05-22 05:23 UTC
• Reptile (Rootkit) - Malware - CyberMaterial
  web:www.cybermaterial.com

  In the ever-evolving landscape of cybersecurity threats, Reptile malware has emerged as a particularly concerning actor, targeting Linux systems with sophisticated techniques. Reptile is a sophisticated open-source rootkit designed to operate stealthily within the kernel of Linux-based systems, making it a formidable challenge for system administrators and cybersecurity professionals. Unlike ...

  2026-05-22 05:23 UTC
• PDF THREAT ADVISORY - hivepro.com
  web:www.hivepro.com

  A Chinese threat group named UNC3886, exploited it in a zero-day attack on Fortinet products. Interestingly, Reptile shares #4 similarities with the Mélofée malware , linking it to the Chinese Winnti attack group. This highlights Reptile's role as an enabler for attackers seeking to breach systems and maintain control over compromised ...

  2026-05-22 05:23 UTC

Only Available for Registered Users. Sign in to view.