MEDUSA

Executive Summary

MEDUSA is an adaptable Linux rootkit that exploits dynamic linker hijacking to inject malicious code into trusted processes, logs credentials during authentication flows, and can remotely execute commands. Its open‑source design reduces development barriers for threat actors, facilitating stealth persistence on compromised systems. Security teams should enforce strict audit controls and monitor shared‑library loading activities.

MEDUSA is a Linux‑specific rootkit that achieves covert persistence by hijacking the dynamic linker mechanism (LD_PRELOAD, ld-*) to inject malicious shared libraries into legitimate system processes such as sshd, cron, and init. Once injected, the rootkit hooks authentication calls—PAM functions and login utilities—to capture user credentials entered during login or sudo sessions, subsequently logging them locally for later exfiltration. Beyond credential theft, MEDUSA can execute arbitrary system commands, enabling remote lateral movement and payload deployment. The tool’s open‑source nature means its source code is publicly available, lowering the barrier for attackers to customize and integrate the rootkit into benign projects or tailor it to target architectures with minimal effort. While documentation exists in public repositories, reports indicate that threat actors are repurposing MEDUSA for stealthy operations inside cloud infra, leveraging the root kit’s ability to evade standard signature‑based detection. In practice, users of MEDUSA can benefit from advanced runtime integrity checks that obscure process listings, and from manipulating audit logs to hide modification events. However, its reliance on core Linux binaries makes it vulnerable to comprehensive file‑integrity monitoring and vigilant host‑based IDS. Overall, MEDUSA presents a potent combination of dynamic linker hijacking, credential logging, and remote command execution—capabilities that are difficult to detect without specific behavioral signatures or continuous system monitoring.

Key Capabilities

• Hijacks the dynamic linker (e.g., LD_PRELOAD) to inject malicious code into legitimate services such as sshd and cron
• Hooks authentication APIs (PAM, login(3)) to capture and log user credentials
• Facilitates remote command execution for lateral movement and payload delivery
• Modifies or monitors critical libraries to evade signature detection
• Conceals malicious activity by manipulating audit and process‑listing utilities

ATT&CK Techniques

Recommended Actions

• Deploy host‑based intrusion detection that logs any tampering of system libraries (e.g., /lib64/ld-linux-x86-64.so.2) and alerts on additions to /etc/ld.so.preload or unexpected LD_PRELOAD usage
• Implement file integrity monitoring across all shared‑library directories (/usr/lib, /lib) and flag any new or altered modules that could be injected

Suggested Tags