OrBit Rootkit Steals SSH and Sudo Credentials From Linux Systems

Key Takeaways

• The OrBit rootkit, previously thought to be custom, is a modified version of the open-source Medusa rootkit, actively deployed since December 2022.
• OrBit targets Linux systems, deeply embedding itself to steal SSH and sudo credentials while evading detection.
• Multiple threat actors, including state-sponsored groups like UNC3886 and eCrime organizations like BLOCKADE SPIDER and RHOMBUS, are leveraging OrBit.
• Newer versions of OrBit, particularly from 2025, can actively forge authentication outcomes, granting attackers full control over login attempts.
• Defenders can identify OrBit through specific file artifacts, hidden directories, and YARA rules designed to detect its core Medusa codebase.

The persistent OrBit rootkit has long been a clandestine threat to Linux environments, designed to pilfer login credentials and maintain an entrenched presence on compromised machines, often sidestepping conventional security measures.

Recent investigations have unveiled a significant development: OrBit, once considered a bespoke piece of malware, is, in fact, a customized iteration of Medusa, a publicly available rootkit. This revelation underscores a widespread adoption by various hacking groups globally.

OrBit’s Modus Operandi

OrBit infiltrates the core of a Linux system, establishing hooks into more than forty fundamental system functions. This deep integration allows it to operate with near-complete invisibility. Once embedded, the rootkit actively monitors for SSH and sudo login attempts, capturing usernames and passwords. These stolen credentials are then stored in a hidden directory, specifically engineered to elude standard system scans. Attackers subsequently leverage a covert SSH backdoor to reconnect to the compromised system, negating the need for internet-facing commands.

Researchers at Intezer detailed in a recent report that OrBit’s codebase is not original. Instead, it is derived from Medusa, an open-source rootkit published on GitHub in December 2022. The threat actors behind OrBit have primarily focused on configuring existing source files, rotating passwords, and altering installation paths to enhance its stealth capabilities, rather than developing new code from scratch.

Hackers Use OrBit Rootkit to Harvest Credentials

Intezer’s comprehensive analysis spanned over a dozen samples of OrBit, collected between 2022 and early 2026. Through static and differential analysis, the research team identified two distinct build paths: “Lineage A,” a full-featured version encompassing the complete attack toolkit, and “Lineage B,” a streamlined variant with reduced features for a smaller footprint. Lineage B deployments appear to have ceased after 2024, suggesting a potential consolidation back to the primary Lineage A build by operators.

OrBit achieves persistence by deploying itself as a shared library file on the target Linux machine. It modifies the dynamic linker configuration, ensuring that the malicious library is automatically loaded into every process running on the system. From this privileged position, OrBit intercepts critical system data, including file reads, directory listings, and network connection information, rendering itself invisible to both system administrators and security tools. The malware secretes captured credentials and configuration data within a hidden directory, /lib/libseconf/, which remains undetectable by standard utilities due to the rootkit’s active hooks.

A significant advancement in OrBit’s capabilities emerged in 2025 with the introduction of a new hook called pam_sm_authenticate, a server-side authentication function. Earlier versions were limited to passively collecting credentials as users entered them. However, this updated version gained the ability to forge authentication outcomes, allowing attackers to approve or deny login attempts on a compromised system at will. Concurrently, a new two-stage delivery mechanism was observed: an initial infector deploys a dropper, which then extracts and installs the rootkit. A cron job is subsequently established to fetch updated payloads from an external domain.

Multiple Hacker Groups Are Exploiting This Backdoor

A particularly alarming finding from this research is the confirmed use of OrBit by at least three distinct hacker groups. Mandiant has tracked the state-sponsored espionage group UNC3886 utilizing the same codebase. This group employed a specific 0xAA encryption key, unique credentials, and an installation path that precisely matched Intezer’s 2024 Lineage A samples.

CrowdStrike’s 2026 Global Threat Report highlighted BLOCKADE SPIDER, an eCrime group notorious for the Embargo ransomware, as another user of OrBit. This group leveraged the rootkit to maintain stealthy access within VMware virtualization environments.

Furthermore, a third campaign observed in 2025 featured a dropper architecture identical to one associated with RHOMBUS, a Linux-based botnet first reported in 2020. Both droppers shared the same C2 domain, which resolves to infrastructure located in Russia.

To aid defenders, it is crucial to monitor for co-occurring filenames such as sshpass.txt, .logpam, and .ports within unexpected directories. These are consistent artifacts of the Medusa build pipeline, irrespective of which operator compiled the rootkit. Implementing YARA rules that can decode the XOR string table with a variable key and match on known plaintext entries can effectively detect any variant of this rootkit family, even those employing fresh credentials and renamed installation paths.

What You Should Do

• Implement robust endpoint detection and response (EDR) solutions capable of detecting rootkit behavior and kernel-level modifications.
• Regularly audit Linux systems for suspicious file paths, particularly /lib/libseconf/, /lib/libntpVnQE6mk/, and /lib/locate/.
• Monitor for the presence of unusual files like sshpass.txt, .logpam, and .ports in unexpected locations.
• Deploy and regularly update YARA rules to identify OrBit/Medusa variants, focusing on string tables and known plaintext entries.
• Enforce strong authentication policies, including multi-factor authentication (MFA) for SSH and sudo access.
• Periodically review and restrict dynamic linker configurations to prevent unauthorized shared library loading.
• Conduct thorough network monitoring for connections to known OrBit C2 domains and IP addresses, such as cf0[.]pw and 109.95.212[.]253.
• Regularly patch and update Linux operating systems and all installed software to mitigate potential initial compromise vectors.

Indicators of Compromise (IoCs)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.