Limon

Limon - Sandbox for Analyzing Linux Malwares Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect the Linux malware before execution, during execution, and...

MalwareSourceCode

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page Liability Disclaimer: To the maximum extent permitted by applicable law, vx-underground and/or affiliates who have submitted content to vx-underground, shall not be liable for any indirect,...

linux-malware

linux-malware Rolling 7 day view of updates from this repo Submissions? Press/academia https://en.wikipedia.org/wiki/Linuxmalware 17 - Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control,...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

sandfly-entropyscan

¿Qué es sandfly-entropyscan? sandfly-entropyscan es una utilidad para escanear rápidamente archivos o procesos en ejecución e informar sobre su entropía medida de aleatoriedad y si son un ejecutable de tipo ELF de Linux/Unix. Algunos malware para Linux están empaquetados o cifrados y muestran una...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

linux-malware-detect

Linux Malware Detect LMD Linux 恶意软件扫描器 — 多阶段威胁检测（MD5、SHA-256、HEX、YARA、统计分析），ClamAV 集成，实时 inotify 监控，隔离/清除/恢复操作，以及多渠道告警（电子邮件、Slack、Telegram、Discord）。 C 2002-2026, R-fx Networks C 2026, Ryan MacDonald 依据 GNU GPL v2 许可 2.0.1 新特性 原生扫描引擎提速 43 倍 — 原生扫描流水线已使用批量并行处理完全重写。基于约 10,000 个文件的真实基准测试： 版本| 运行时间| 文...

yara-rules

yara-rules Colección de firmas YARA de investigaciones recientes de malware Conjunto de reglas Dacls Trojan Regla: DaclsLinux.yara Regla: DaclsWindows.yara Referencia: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown Regla: APT32KerrDown.yara Referencia:...

Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor

Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. "Showboat is a modular post-exploitation framework designed for Linux systems, capable...

linux-malware-toolbox

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

linux-malwares

Linux Malware Samples - Educational Repository ⚠️ IMPORTAN...

VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code

The recently discovered sophisticated Linux malware framework known as VoidLink is assessed to have been developed by a single person with assistance from an artificial intelligence AI model. That's according to new findings from Check Point Research, which identified operational security blunder...

New China Linked VoidLink Linux Malware Targets Major Cloud Providers

Researchers have discovered VoidLink, a sophisticated new Linux malware framework designed to infiltrate AWS, Google Cloud, and Azure. Learn how this Chinese-affiliated toolkit uses adaptive stealth to stay hidden...

New Advanced Linux VoidLink Malware Targets Cloud and container Environments

Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term, stealthy access to Linux-based cloud environments According to a new report from Check Point Research, the cloud-native...

China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe. The activity cluster, which has been active since at least 2022, primarily focuses on extensive technical reconnaissance of target organizations...

ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other. Here's a quick rundown of the latest cyber stories that show how fast the game keeps changing...

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

A Pakistan-nexus threat actor has been observed targeting Indian government entities as part of spear-phishing attacks designed to deliver a Golang-based malware known as DeskRAT. The activity, observed in August and September 2025 by Sekoia, has been attributed to Transparent Tribe aka APT36, a...

EUVD-2025-13634

Malicious code in bioql PyPI...

CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems

Cybersecurity researchers have discovered two new malware families, including a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access trojan RAT named ZynorRAT that can target both Windows and Linux systems. According to an analysis from Jamf Threat Labs, ChillyHell is writt...

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell. The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a...