Ghost in the Shell: Unmasking the QLNX Rootkit
QLNX is an advanced Linux rootkit engineered for kernel-level stealth, privilege concealment and long-term covert access – hiding processes, tampering with telemetry, and evading detection across servers, cloud workloads and internet-facing systems.
- Rootkit
- Linux
Bottom line. Treat any QLNX detection as a critical, rootkit-level compromise of system integrity: isolate the host, capture memory for offline forensics, validate kernel integrity, and rebuild from known-good media. In-place remediation cannot be trusted once the kernel is subverted.
Background
Modern Linux rootkits mark a significant escalation in attacker capability, particularly across cloud, containerized and enterprise-server environments. By operating below traditional visibility layers, stealth-focused malware reduces defender awareness and extends dwell time inside compromised networks.
QLNX demonstrates advanced rootkit functionality centred on stealth persistence and suppressing forensic visibility. It manipulates low-level operating-system behaviour to conceal attacker presence, hide malicious processes, and bypass conventional monitoring controls – an operational design built for long-term covert access.
What we observed
Analysis indicates sophisticated kernel-level manipulation and anti-forensic tradecraft:
- Kernel-level manipulation: intercepts system calls and manipulates OS telemetry to suppress the visibility of malicious artifacts, even in monitored environments.
- Process and credential concealment: hides malicious processes and conceals credentials from standard administrative tooling.
- Stealth persistence: hidden kernel modules, process cloaking and privileged execution maintain long-term access.
- Anti-forensics and evasion: tampers with audit logs and selectively evades endpoint monitoring solutions.
QLNX stealth chain
Operating inside the kernel, QLNX makes the operating system itself hide the intrusion.
Attribution
The tradecraft is consistent with a highly capable intrusion actor targeting Linux infrastructure and internet-facing systems. No confirmed attribution to a named threat group is established from the available analysis; the assessment is based on capability and design rather than actor-specific indicators.
A kernel rootkit doesn’t hide from the defender – it makes the operating system lie on the attacker’s behalf.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Defense Evasion | Rootkit | T1014 | Kernel-level concealment hides processes, files and artifacts from standard tooling. |
| Defense Evasion | Impair Defenses | T1562 | Interferes with and selectively evades endpoint monitoring and tampers with audit logs. |
| Defense Evasion | Reflective Code Loading | T1620 | Loads code stealthily to reduce on-disk artifacts, consistent with the observed tradecraft. |
Detection
Copy-ready hunting query:
# Hunt for hidden kernel modules / syscall hooks (Linux)
lsmod | sort > /tmp/lkm.now
diff /tmp/lkm.baseline /tmp/lkm.now
# Modules present in /sys but not in lsmod = possible hidden module
comm -13 <(lsmod | awk 'NR>1{print $1}' | sort) <(ls /sys/module | sort)
# Audit module loads and review for tampering
auditctl -w /sbin/insmod -p x -k lkm_load
ausearch -k lkm_load -ts recentRecommendations
- Isolate the host from the network immediately and preserve volatile evidence (RAM) for offline forensic analysis before powering down.
- Validate kernel integrity against known-good baselines – treat any hidden module, unexpected syscall hook or tampered audit log as confirmation of compromise.
- Do not remediate in place: rebuild or reimage affected systems from trusted media and rotate any credentials that may have been exposed.
- Raise the bar for kernel tampering with eBPF/kernel-level monitoring, module-load auditing, and Secure Boot with kernel module signing.
