Unmasked Origin: Infamous “OrBit” Linux Rootkit Exposed as a Fork of Open-Source Medusa

Nicole at Intezer demonstrates that OrBit — initially reported as a bespoke Linux rootkit — is actually a weaponized fork of the open-source Medusa LD_PRELOAD rootkit. Deployed as a shared library that patches ld.so for system-wide persistence, OrBit provides a passive SSH backdoor, PAM credential harvesting and file hiding; it has split into a full and a lite lineage and has been adopted by multiple actors (including UNC3886 and BLOCKADE SPIDER) with recent samples adding active C2 and credential-forging capabilities via cron-based fetches (e.g., cf0.pw).