Linux rootkits explained – Part 2: Loadable kernel modules

This Wiz Research blog post explains Linux Loadable Kernel Module (LKM) rootkits: what LKMs are, how attackers hook kernel functions (syscall table, kprobes, ftrace, VFS), real-world examples and actors (e.g., Diamorphine, Reptile, adore-ng, Syslogk, TeamTNT, Winnti), a demo showing hiding files via a getdents hook, and practical detection and mitigation recommendations (avoid privileged containers, use AppArmor/SELinux, secure boot).