New stealthy Pumakit Linux rootkit malware spotted in the wild

Elastic Security details Pumakit, a sophisticated Linux rootkit campaign composed of a memory-resident dropper, an LKM kernel module (puma.ko) and a userland shared object (Kitsune SO). The malware conditionally activates on older kernels (pre-5.7), leverages kallsyms_lookup_name and ftrace to hook syscalls and abuse prepare_creds/commit_creds for stealthy privilege escalation, hides files/processes/network artifacts, and communicates with a C2; Elastic published YARA rules and file hashes to aid detection.