Singularity Linux Kernel Rootkit with New Feature Prevents Detection

**Singularity** is a sophisticated Linux kernel rootkit (LKM) targeting Linux 6.x that leverages ftrace-based syscall hooking to provide deep stealth and persistent root access. It can hide processes, files, and network connections, uses an ICMP-triggered reverse shell for covert C2, sanitizes logs and clears kernel taint to evade forensics, and includes mechanisms to block eBPF-based monitoring and other kernel protections—posing a high-risk threat to Linux deployments despite no evidence in this report of active exploitation.