ShadowGuard rootkit and Diaoyu loader on Linux
Malware Activity
Summary
Hide ▲
Show ▼
Researchers identified the ShadowGuard Linux eBPF rootkit and Diaoyu loader as part of the operation’s malware toolkit, adding a stealthy Linux payload-delivery layer that can hide processes and fetch Cobalt Strike or VShell. The tooling is built to evade inspection before loading follow-on payloads. ShadowGuard can conceal up to 32 PIDs and hide files and directories named swsecret. The finding shows a purpose-built malware stack rather than generic phishing infrastructure.
Related Happenings
Gentlemen ransomware EDR-killer tooling
Malware Activity
H score35
First: 19.06.2026 01:31
Last: 19.06.2026 01:31
Sources 1
About this happening:
Gentlemen ransomware-as-a-service (RaaS) is actively maintaining a suite of EDR killers led by GentleKiller to disable endpoint defenses before encryption. ESET says t...
Gentlemen ransomware EDR-killer tooling
Malware ActivityAbout this happening: Gentlemen ransomware-as-a-service (RaaS) is actively maintaining a suite of EDR killers led by GentleKiller to disable endpoint defenses before encryption. ESET says t...
Gremlin stealer modular toolkit evolution
Malware Activity
H score21
First: 15.05.2026 17:19
Last: 15.05.2026 17:19
Sources 1
About this happening:
The Gremlin stealer malware has expanded into a modular toolkit with session-hijacking and crypto clipping capabilities, raising the risk of credential theft and a...
Gremlin stealer modular toolkit evolution
Malware ActivityAbout this happening: The Gremlin stealer malware has expanded into a modular toolkit with session-hijacking and crypto clipping capabilities, raising the risk of credential theft and a...
World Leaks RustyRocket malware activity
Malware Activity
H score38
First: 12.02.2026 15:30
Last: 12.02.2026 15:30
Sources 1
About this happening:
The World Leaks extortion group has added RustyRocket, a new Rust malware that helps it maintain persistence and exfiltrate data from victim networks. The tool...
World Leaks RustyRocket malware activity
Malware ActivityAbout this happening: The World Leaks extortion group has added RustyRocket, a new Rust malware that helps it maintain persistence and exfiltrate data from victim networks. The tool...
Reynolds ransomware BYOVD defense-evasion activity
Malware Activity
H score31
First: 10.02.2026 16:36
Last: 10.02.2026 16:36
Sources 1
About this happening:
The Reynolds ransomware family now matters because it bundles a vulnerable NsecSoft NSecKrnl driver inside the payload to disable EDR and terminate security processes...
Reynolds ransomware BYOVD defense-evasion activity
Malware ActivityAbout this happening: The Reynolds ransomware family now matters because it bundles a vulnerable NsecSoft NSecKrnl driver inside the payload to disable EDR and terminate security processes...
TGR-STA-1030/UNC6619 Shadow Campaigns espionage operation
Campaign
H score30
First: 07.02.2026 17:09
Last: 07.02.2026 17:09
Sources 1
How related:
A state-sponsored threat group has compromised dozens of networks of government and critical infrastructure entities in 37 countries in global-scale operations dubbed 'Shadow Campaigns'.
About this happening:
The TGR-STA-1030/UNC6619 operation Shadow Campaigns expanded a state-sponsored espionage effort that compromised at least 70 organizations across 37 countries, inc...
TGR-STA-1030/UNC6619 Shadow Campaigns espionage operation
CampaignHow related: A state-sponsored threat group has compromised dozens of networks of government and critical infrastructure entities in 37 countries in global-scale operations dubbed 'Shadow Campaigns'.
About this happening: The TGR-STA-1030/UNC6619 operation Shadow Campaigns expanded a state-sponsored espionage effort that compromised at least 70 organizations across 37 countries, inc...
Timeline
-
07.02.2026 17:09 1 articles · 5mo ago
Diaoyu loader and ShadowGuard rootkit analysis
Technical Analysis UpdateResearchers detailed a Linux malware toolkit used in Shadow Campaigns that pairs the Diaoyu loader with a custom eBPF rootkit called ShadowGuard. The loader arrives through malicious archives hosted on Mega.nz, checks for pic1.png and security-product processes such as Kaspersky, Avira, Bitdefender, Sentinel One, and Norton (Symantec), and can fetch Cobalt Strike payloads or the VShell framework when its analysis-evasion checks succeed. ShadowGuard hides malicious process information at the kernel level and conceals files and directories to help the operator maintain stealth on compromised Linux hosts.
Show sources
- State actor targets 155 countries in 'Shadow Campaigns' espionage op — www.bleepingcomputer.com — 07.02.2026 17:09