TF-MAL-elf.symbiote

Description

ThreatFox malware family `elf.symbiote`. Printable name: Symbiote.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• BPFDoor and Symbiote Rootkits Attacking Linux Systems Exploiting eBPF ...
  web:cybersecuritynews.com

  Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote , both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.

  2026-05-22 05:23 UTC
• BPFDoor and Symbiote: Advanced eBPF-Based Rootkits Target ... - GBHackers
  web:gbhackers.com

  The 2025 variants confirm that eBPF malware authors actively enhance their tools to evade detection. Symbiote's expanded port list and UDP support, combined with BPFDoor's IPv6 capabilities and DNS traffic camouflage, represent calculated responses to modern network monitoring practices.

  2026-05-22 05:23 UTC
• Symbiote: A New, Nearly-Impossible-to-Detect Linux Threat - Intezer
  web:intezer.com

  Symbiote is a new Linux® malware we discovered that acts in a parasitic nature, infecting other running processes to inflict damage on machines.

  2026-05-22 05:23 UTC
• Symbiote (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  A malware capable of capturing credentials and enabling backdoor access, implemented as a userland rootkit. It uses three methods for hiding its network activity, by hooking and hijacking 1) fopen/fopen64, 2) eBPF, 3) a set of libpcap functions.

  2026-05-22 05:23 UTC
• Symbiote & BPFdoor Malware - X-Industry - Red Sky Alliance
  web:redskyalliance.org

  Comparing BPFDoor variants - Besides Symbiote , Linux/BPFDoor is the other significant malware family that abuses BPF. It appeared in 2021, but analysts found a significant number of new variants in 2025 (240 samples since 2021, 150 in 2025 alone). What are the differences? Are they just minor, or are there new features?

  2026-05-22 05:23 UTC
• The Symbiote Malware: What We Know So Far - The New Stack
  web:thenewstack.io

  Here's what we know so far. What's in a Name? Aptly named Symbiote , this malware needs to infect other running processes to cause any damage on the infected machine. Unlike other forms of malware that typically present themselves as executable files, Symbiote is a shared object library.

  2026-05-22 05:23 UTC
• Symbiote and BPFdoor Linux malware variants implement new eBPF filters
  web:www.broadcom.com

  Symbiote and BPFdoor are two Linux malware strains known to utilize Berkeley Packet Filter (BPF) packet sniffer to monitor network traffic and send packets only on existing open ports, bypassing firewall rules and network protections. As reported by researchers from Fortinet, both called out malware families have recently implemented new extended Berkeley Packet Filters (eBPFs) within the ...

  2026-05-22 05:23 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:23 UTC
• New eBPF Filters for Symbiote and BPFdoor Malware
  web:www.fortinet.com

  FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.

  2026-05-22 05:23 UTC
• Inside Symbiote: Malware Deep Dive - Zerone Security
  web:zeronesecurity.com

  Inside Symbiote : Malware Deep Dive Symbiosis is a close and long-term biological interaction between two different biological organisms, either mutual or parasitic. In this case, this userland-level rootkit is named " Symbiote ".

  2026-05-22 05:23 UTC

Only Available for Registered Users. Sign in to view.