Rootkit

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.^[1][2]

APT41 deployed rootkits on Linux systems.^[3][4]

Carberp has used user mode rootkit techniques to remain hidden on the system.^[5]

Caterpillar WebShell has a module to use a rootkit on a system.^[6]

COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.^[7]

Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.^[8]

Ebury acts as a user land rootkit using the SSH service.^[9][10]

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.^[11]

HiddenWasp uses a rootkit to hook and implement functions on the system.^[12]

HIDEDRV is a rootkit that hides certain operating system artifacts.^[13]

Hikit is a Rootkit that has been used by Axiom.^{[14] [15]}

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().^[16]

HTRAN can install a rootkit to hide network connections from the host OS.^[17]

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.^[2]

PoisonIvy starts a rootkit from a malicious file dropped to disk.^[18]

Ramsay has included a rootkit to evade defenses.^[19]

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.^[20]

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.^[21]

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.^[22]

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.^{[23] [24]}

Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.^[25]

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.^[26][27]

WarzoneRAT can include a rootkit to hide processes, files, and startup.^[28]

Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.^[29]

Winnti Group used a rootkit to modify typical server functionality.^[30]

Zeroaccess is a kernel-mode rootkit.^[31]