OrBit Rootkit Steals SSH & Sudo Credentials from Hackers Harvest

For years, the stealthy OrBit rootkit has quietly targeted Linux systems. It operates by stealing login credentials and deeply embedding itself within compromised machines, often evading detection from most security tools.

New research reveals that what was once believed to be a custom-built threat is actually a modified version of a publicly available rootkit, spreading across the globe through multiple hacker groups.

OrBit works by embedding itself into the core of a Linux system, hooking into more than forty basic system functions so that it becomes almost completely invisible.

Once inside a machine, it listens for login attempts through SSH and sudo, capturing usernames and passwords and saving them in a hidden directory that standard system scans cannot detect.

The attacker then connects back to the compromised system through a secret SSH backdoor, never needing to send commands across the internet.

Researchers at Intezer, said in a report shared with Cyber Security News (CSN), identified that OrBit is not original code at all.

It is actually built from a publicly available rootkit called Medusa, published on GitHub in December 2022.

The operator work done by hackers was not about writing new code but about configuring existing source files, rotating passwords, and changing install paths to stay hidden.

Hackers Use OrBit Rootkit

Intezer’s analysis tracked more than a dozen samples spanning from 2022 through early 2026.

The team walked each sample through static and differential analysis and discovered two separate build paths: a full-featured version called Lineage A, which carries the complete attack toolkit, and a stripped-down version called Lineage B, which drops several features for a lighter footprint.

Lineage B appears to have stopped surfacing after 2024, suggesting operators may have consolidated back into the main build.

OrBit is deployed as a shared library file on the target Linux machine. It achieves persistence by modifying the dynamic linker configuration so that the malicious library loads automatically into every process running on the system.

From that position, it intercepts file reads, directory listings, and network connection data, making itself invisible to both administrators and security tools.

The malware stores captured credentials and configuration data in a hidden directory called /lib/libseconf/, which standard tools cannot see due to the rootkit’s own hooks.

The most significant capability jump came in 2025, when the newest build added a hook called pam_sm_authenticate, a server-side authentication function.

Where earlier versions could only passively collect credentials when users typed them, this new version can also forge authentication outcomes, meaning attackers can approve or deny login attempts on a compromised system at will.

That same year, a new two-stage delivery chain appeared: an infector embeds a dropper, which then extracts and installs the rootkit, with a cron job created to fetch updated payloads from an external domain.

Multiple Hacker Groups Are Exploiting This Backdoor

One of the most alarming findings from this research is that at least three distinct hacker groups have been using OrBit.

The state-sponsored espionage group UNC3886, tracked by Mandiant, used the same codebase with a specific 0xAA encryption key, distinct credentials, and an install path that matched Intezer’s 2024 Lineage A samples exactly.

CrowdStrike noted in its 2026 Global Threat Report that BLOCKADE SPIDER, an eCrime group known for Embargo ransomware, used OrBit to quietly maintain access inside VMware virtualization environments.

A third campaign observed in 2025 used a dropper architecture identical to one linked to RHOMBUS, a Linux-based botnet first reported in 2020, with both droppers sharing the same C2 domain resolving to infrastructure in Russia.

Defenders are advised to monitor for co-occurring filenames such as sshpass.txt, .logpam, and .ports appearing inside unexpected directories, as these are fixed artifacts of the Medusa build pipeline regardless of which operator compiled the rootkit.

YARA rules that decode the XOR string table with a variable key and match on known plaintext entries can catch any version of this family, even builds using fresh credentials and renamed install paths.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.