PoC rootkit Curing evades traditional Linux detection systems

Armo researchers published a proof-of-concept rootkit called Curing that abuses Linux's io_uring asynchronous I/O to perform network and filesystem operations without making traditional syscalls, rendering syscall-based monitoring ineffective. The report demonstrates C2 communication and multiple malicious actions, provides PoC code and vendor testing results (many tools missed activity while some detected/mitigated it), and recommends detection improvements such as LSM hooks and careful eBPF placement.