CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Linux OrBit Rootkit Evolution and AI-Driven Intrusions Surge in Latin America

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Linux userland rootkit OrBit has been actively maintained and refined by its operators nearly four years after its initial discovery, with evidence of two distinct lineages—Lineage A (full-featured) and Lineage B (lite)—indicating ongoing development and deployment. The malware, attributed to Blockade Spider and linked to the Embargo ransomware campaign, employs advanced evasion techniques, persistence mechanisms, and credential harvesting. Concurrently, two AI-driven intrusion campaigns—SHADOW-AETHER-040 and SHADOW-AETHER-064—have emerged, leveraging agentic AI to conduct intrusions against governments and financial institutions in Latin America, bypassing AI safety controls by framing activities as authorized penetration testing. These developments highlight the convergence of sophisticated rootkit technology and AI-enabled intrusion operations, underscoring the evolving threat landscape for both Linux environments and cloud-based infrastructures.

Timeline

  1. 21.05.2026 14:52 1 articles · 2h ago

    AI-driven intrusion campaigns and Linux OrBit rootkit evolution disclosed

    OrBit Linux rootkit operators maintain two lineages—Lineage A (full-featured) and Lineage B (lite)—with continuous evasion and persistence enhancements. Concurrently, SHADOW-AETHER-040 and SHADOW-AETHER-064 campaigns deploy agentic AI to conduct intrusions against government and financial targets in Latin America, leveraging commercial AI models and bypassing safety controls by framing activities as penetration testing.

    Show sources
    Open in new tab

Information Snippets