TF-MAL-elf.pumakit

Description

ThreatFox malware family `elf.pumakit`. Printable name: PUMAKIT. Aliases: PUMA,Kitsune.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Declawing PUMAKIT | 133742 Personal Blog
  web:1337-42.github.io

  PUMAKIT isn't your everyday piece of malware—it's a cunning Linux rootkit that stays hidden in plain sight. Through a mix of memory-only binaries, loadable kernel modules, and clever syscall hooking, it achieves deep system infiltration without leaving obvious footprints behind. Unlike traditional rootkits, PUMAKIT twists even the simplest commands to its advantage, using tactics like ...

  2026-05-22 05:22 UTC
• PUMAKIT Rootkit Threatens Linux Systems Worldwide
  web:cybersecsentinel.com

  Threat Group: Unknown Threat Type: Rootkit Exploited Vulnerabilities: Targets Linux kernels prior to version 5.7 Malware Used: PUMAKIT Threat Score: High (8.0/10) - Due to its advanced stealth capabilities and potential impact on critical infrastructure. Last Threat Observation: December 13, 2024, by Elastic Security Labs Overview PUMAKIT is

  2026-05-22 05:22 UTC
• New Stealthy Linux Malware PUMAKIT With Unique Privilege Escalation Methods
  web:cybersecuritynews.com

  Security researchers at Elastic Security Labs have uncovered a sophisticated Linux malware dubbed PUMAKIT , which employs advanced stealth techniques and unique privilege escalation methods to maintain persistence on infected systems.

  2026-05-22 05:22 UTC
• PDF Threat Advisory - hivepro.com
  web:hivepro.com

  Malware : PUMAKIT Attack: A newly discovered Linux rootkit malware , named Pumakit , employs sophisticated stealth techniques and advanced privilege escalation methods to remain undetected on compromised systems. This malware is a multi-faceted threat, consisting of several components: a dropper, memory-resident executables, a kernel module rootkit, and a shared object (SO) userland rootkit. This ...

  2026-05-22 05:22 UTC
• PUMAKIT Malware: Multi-Stage Threats and Evasion Strategies
  web:linuxsecurity.com

  The recently discovered PUMAKIT loadable kernel module (LKM) rootkit stands out as an advanced example of multi-stage malware , operating over multiple stages to avoid detection and establish control on targeted systems. It does not simply plant malicious software; instead. It involves an intricate web of activities starting with droppers, memory executables, and rootkits before finally ...

  2026-05-22 05:22 UTC
• PUMAKIT (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  According to Elastic, PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control servers. The rootkit component, referenced by the malware authors as "PUMA", employs an internal Linux function tracer (ftrace) to hook 18 different syscalls and several kernel functions ...

  2026-05-22 05:22 UTC
• PUMAKIT, a sophisticated rootkit that uses advanced stealth mechanisms
  web:securityaffairs.com

  The LKM rootkit demonstrates this behavior" The rmdir_hook() function in PUMAKIT's kernel module intercepts rmdir() syscalls to manipulate directory operations. The malware uses it for privilege escalation and to retrieve configuration details based on a structured input pattern.

  2026-05-22 05:22 UTC
• New stealthy Pumakit Linux rootkit malware spotted in the wild
  web:www.bleepingcomputer.com

  A new Linux rootkit malware called Pumakit has been discovered that uses stealth and advanced privilege escalation techniques to hide its presence on systems.

  2026-05-22 05:22 UTC
• Declawing PUMAKIT — Elastic Security Labs
  web:www.elastic.co

  Concluding Statement PUMAKIT is a complex and stealthy threat that uses advanced techniques like syscall hooking, memory-resident execution, and unique privilege escalation methods. Its multi-architectural design highlights the growing sophistication of malware targeting Linux systems. Elastic Security Labs will continue to analyze PUMAKIT , monitor its behavior, and track any updates or new ...

  2026-05-22 05:22 UTC
• Declawing PUMAKIT | RGROSEC
  web:www.rgrosec.com

  Declawing PUMAKIT Overview At Elastic Security Labs, we uncovered PUMAKIT , a sophisticated multi-stage Linux malware with advanced rootkit capabilities. Initially identified through routine threat hunting on VirusTotal, PUMAKIT consists of a dropper (cron), two memory-resident executables, an LKM rootkit module, and a userland shared object (SO) rootkit.

  2026-05-22 05:22 UTC

Only Available for Registered Users. Sign in to view.