Skidmap

Executive Summary

Skidmap is a kernel‑mode rootkit that covertly mines cryptocurrency on affected Linux systems. The malware hijacks system resources without user authorization and hides itself from standard detection methods. This threat poses both performance degradation risks and financial exploitation, requiring specialized monitoring to detect hidden modules and abnormal CPU usage.

Skidmap is a Linux kernel‑mode rootkit whose primary purpose is to hijack system resources for cryptocurrency mining. Once loaded into the kernel, it can remain persistent across reboots by integrating itself as a loadable module and leveraging init scripts or crontab entries. The rootkit manipulates kernel structures to conceal its presence, hiding processes, files, and network connections that would otherwise alert administrators. In addition to stealth, Skidmap exploits CPU cycles by launching mining threads that consume substantial processing power, often at the expense of legitimate workloads. By running in privileged mode it may bypass typical user‑level security controls and evade standard antivirus detection. The rootkit’s design aims for long‑term persistence, allowing attackers to maximize mining profitability while remaining hidden within the host environment. Due to its kernel‑level operation, detecting Skidmap can be challenging; normal file‑system scans or conventional malware signatures are ineffective as the malicious code resides in memory rather than on disk. Administrators must therefore rely on kernel audit logs, module monitoring tools, and behavioral anomaly detection focused on abnormal CPU usage and hidden modules. Overall, Skidmap represents a sophisticated threat that combines stealthy persistence with resource‑hijacking capabilities, making it a notable concern for Linux environments where financial gain can be pursued silently over extended periods.

Key Capabilities

• Loads a kernel module that persists across reboots
• Hijacks CPU cycles for cryptocurrency mining without user consent
• Hides processes, files, and network connections through kernel manipulation
• Evades typical antivirus signatures by residing exclusively in memory
• Can modify init scripts or crontab entries to ensure persistence

ATT&CK Techniques

Recommended Actions

• Surveil dmesg and audit logs for unknown or suspicious kernel modules
• Implement kernel module black‑listing on trusted distributions
• Utilize host‑based intrusion detection systems that flag abnormal CPU usage patterns
• Regularly scan system memory with rootkit detection tools (e.g., chkrootkit, rkhunter)
• Apply the latest vendor patches for Linux kernels and keep distribution up to date
• Disable or secure privileged access points that could be used to load unauthorized modules

Suggested Tags