Linux rootkits explained – Part 1: Dynamic linker hijacking

This report explains how Linux dynamic linker hijacking using `LD_PRELOAD` and `/etc/ld.so.preload` can be abused as a userland rootkit to intercept libc functions, hide files/processes, harvest credentials, and gain persistence. It includes a practical C example that interposes `readdir`, documents real-world campaigns (Winnti for Linux, TeamTNT, Symbiote, OrBit), and recommends detection methods such as checking `/etc/ld.so.preload`, per-process `/proc/{pid}/environ`, filesystem snapshot comparisons, and runtime sensors.