Essential Insights
- OrBit, a stealthy Linux rootkit derived from the publicly available Medusa, has been used by multiple hacker groups since 2022 to steal credentials and maintain covert access.
- It embeds deeply into Linux systems, hooks into over forty core functions, and hides in system files, making detection difficult while capturing login info via SSH and sudo.
- A significant enhancement in 2025 allowed OrBit to forge authentication outcomes, granting attackers near-total control over login permissions on compromised systems.
- Multiple threat actors, including state-sponsored and cybercrime groups, have exploited OrBit, using consistent artifacts and indicators like specific filenames and YARA rules for detection.
The Issue
A covert threat called OrBit has been silently targeting Linux systems for several years. Initially believed to be custom-made, recent research shows that it’s actually a modified version of a publicly available rootkit named Medusa, shared on GitHub in December 2022. This rootkit embeds itself into the Linux core by hooking over forty system functions, making it nearly invisible. Once inside, it captures login credentials, storing them secretly and connecting back through a hidden SSH backdoor, avoiding detection. Over time, hackers have upgraded OrBit, adding capabilities like forging authentication results in 2025, which allows them to control login attempts. Disturbingly, multiple hacker groups—including a state-sponsored espionage group, an eCrime organization, and a botnet operator—have exploited this backdoor, using it to maintain persistent access and steal sensitive information. Security researchers from Intezer and cybersecurity firms like CrowdStrike have identified various samples and shared indicators of compromise, warning defenders to remain vigilant for consistent artifacts and employ detection rules.
Risk Summary
The issue “Hackers Use OrBit Rootkit to Harvest SSH and Sudo Credentials From Linux Systems” can threaten your business by secretly gaining access to your critical systems. Once the rootkit embeds itself, hackers can stealthily steal sensitive SSH and Sudo passwords, which are like master keys. Consequently, this allows them to escalate their privileges and control your servers unnoticed. As a result, your confidential data, customer information, and intellectual property become vulnerable to theft or damage. Moreover, such breaches can lead to operational disruptions, reputational harm, and hefty financial losses. Therefore, any business running Linux systems must recognize that ignoring these threats opens the door to severe security incidents with lasting impacts.
Possible Action Plan
Prompted by the increasing sophistication of cyber threats, swift remediation becomes essential to minimize damage, prevent lateral movement, and protect sensitive data. When hackers exploit tools like the OrBit rootkit to harvest SSH and Sudo credentials from Linux systems, rapid action is critical to contain the breach and restore security.
Containment Strategies
- Isolate compromised systems from the network to prevent further infiltration.
- Disable remote access and suspend affected user accounts immediately.
Detection and Analysis
- Conduct thorough system scans using updated anti-rootkit tools.
- Review system logs for suspicious activities or anomalies indicating rootkit presence.
Remediation Actions
- Remove the rootkit using specialized malware removal tools, or reinstall the OS if necessary.
- Patch all identified vulnerabilities that facilitated the rootkit installation.
- Change all SSH and Sudo credentials, ensuring strong, unique passwords are used.
Recovery Procedures
- Reintroduce cleaned systems into the network only after comprehensive testing.
- Implement enhanced monitoring to identify future malicious activities early.
Prevention Measures
- Regularly update and patch system software and security tools.
- Enforce strict access controls and multi-factor authentication for privileged accounts.
- Maintain up-to-date backups for swift recovery in case of compromise.
Explore More Security Insights
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
