“OrBit,” an emerging and previously undetected Linux malware, has been discovered by Intezer researchers and observed infecting all running processes as well as new processes on the targeted machine. Researchers noted that the malware can be installed either with persistence capabilities or as a resilient implant that enables advanced evasion techniques. OrBit also gains persistence by “hooking key functions, provides the threat actors with remote access capabilities over SSH, harvesting credentials, and logs TYY commands.” OrBit evades detection through filtering the logs to hide all traces of its existence. Researchers explained that OrBit utilizes two (2) ways of loading the malicious library in order to achieve persistence as well as make it difficult to remove the malware from a machine while it’s running. The first method is through the addition of a shared object to the “/etc/ld.so.reload” configuration file that is used by the loader. The second method is through copying the loader’s binary and replacing the “/etc/ld.so.preload” string with a file path within the %MALWARE_FOLDER% so it will act as the configuration file. This methodology is unlike other Linux malware (such as Symbiote, HiddenWasp, etc.), which typically just modifies an environment variable to seize shared libraries. OrBit’s dropper and payload were previously undetected by anti-virus engines when first discovered, but some vendors have since updated their products. An in-depth technical analysis of OrBit as well as indicators of compromise (IOCs) can be viewed in Intenzer’s report linked below.