{
  "family": "reptile",
  "sample_count": 13,
  "category": "backdoor",
  "description": "Rootkit:Linux/Reptile is an incredibly advanced, open-source Linux Loadable Kernel Module (LKM) rootkit. Designed for ultimate stealth, Reptile operates at the deepest level of the Linux operating system (Ring 0 / Kernel space). It is heavily utilized by sophisticated threat actors and Advanced Persistent Threats (APTs) to maintain long-term, completely invisible persistence on compromised Linux servers, often remaining undetected for years.<br><br><b>Understanding the Reptile Rootkit</b><br>To a system administrator, a server infected with Reptile appears entirely normal. Standard commands like `ls`, `ps`, `netstat`, and `top` will not show the attacker's files, processes, or network connections. For a security analyst, a Kernel Rootkit is the worst-case scenario. Because the malware controls the kernel, it controls reality for the rest of the operating system. If an administrator asks the kernel 'list the files in this directory,' the Reptile-infected kernel simply lies, omitting the attacker's tools.<br><br><b>Execution and Kernel Subversion Mechanics</b><br>Attackers typically deploy Reptile after exploiting a vulnerability (e.g., a web application flaw) and escalating privileges to `root` (`T1068`), as kernel modules cannot be loaded by standard users. The attacker compiles the Reptile LKM (often customized for the specific target kernel version) and inserts it using the `insmod` or `modprobe` command (`T1547.006`). Once loaded, Reptile aggressively hooks critical kernel functions (like the VFS layer and system calls) (`T1014`). This allows it to completely hide specific files, directories, processes, and network ports (often a reverse shell listening on a hidden port) from all user-space monitoring tools. Furthermore, Reptile includes a magic 'knock' sequence; it sniffs network traffic and only opens its backdoor when it receives a specific, secretly crafted packet from the attacker (`T1205.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, invisible compromise of the Linux server. Detection is exceptionally difficult. Standard antivirus and EDR agents running in user-space are completely blind to Reptile. Incident responders must rely on kernel-level memory analysis (using tools like Volatility or Rekall on a memory dump) or offline disk analysis (mounting the drive in a clean OS) to find the hidden files. Unexplained discrepancies between network traffic seen at the hardware firewall and traffic reported by the local OS (netstat) can indicate a hidden rootkit port.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.006",
    "T1562.001",
    "T1068",
    "T1014",
    "T1205.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1547.006",
      "name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions (LKM)",
      "tactic": "Persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit (Kernel Hooking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1205.001",
      "name": "Traffic Signaling: Port Knocking (Hidden Backdoor)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (Required for LKM insertion)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Hiding from EDR)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the compromised server from the network, but do NOT power it down if you intend to perform forensics, as the rootkit resides in volatile kernel memory.",
    "Assume the server is fundamentally compromised. You cannot trust any output from commands run on the live, infected system.",
    "Capture a full memory image (RAM dump) of the Linux server for kernel forensics to identify the hooked functions and extract the attacker's configuration.",
    "The only secure remediation for a Kernel Rootkit infection is a complete wipe and bare-metal reinstall of the operating system. Do not attempt to 'clean' it."
  ],
  "what_to_avoid": [
    "Do not trust the output of `lsmod` (list modules); Reptile is designed to instantly unlink itself from the module list to hide its presence.",
    "Avoid relying on standard file integrity monitoring (FIM) tools running on the infected OS, as the rootkit will intercept their reads and return clean data."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}