STEALTHY LINUX ROOTKIT FOUND IN THE WILD AFTER GOING UNDETECTED FOR 2 YEARS

Summary from the TLDR InfoSec newsletter

Krasue is a Linux Remote Access Trojan (RAT) that has been active since 2020, primarily targeting organizations in Thailand. The malware utilizes multiple embedded rootkits drawn from open-source code to support different Linux kernel versions, a common technique for Linux rootkits. Krasue leverages its rootkit capabilities to hook functions like kill() system calls, network operations, and file listing to hide malicious activity and evade detection.