Rootkit

APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.^[5][6]

APT41 deployed rootkits on Linux systems.^[7][8]

Carberp has used user mode rootkit techniques to remain hidden on the system.^[9]

Caterpillar WebShell has a module to use a rootkit on a system.^[10]

Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.^[11]

Ebury has used user mode rootkit techniques to remain hidden on the system.^[12]

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.^[13]

HiddenWasp uses a rootkit to hook and implement functions on the system.^[14]

HIDEDRV is a rootkit that hides certain operating system artifacts.^[15]

Hikit is a Rootkit that has been used by Axiom.^{[16] [17]}

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().^[18]

HTRAN can install a rootkit to hide network connections from the host OS.^[19]

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.^[6]

PoisonIvy starts a rootkit from a malicious file dropped to disk.^[20]

Ramsay has included a rootkit to evade defenses.^[21]

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.^[22]

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.^[23]

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.^[24]

TeamTNT has used the open-source rootkit Diamorphine to hide cryptocurrency mining activities on the machine.^[25]

Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.^[26]

Uroburos is a rootkit used by Turla.^[27]

WarzoneRAT can include a rootkit to hide processes, files, and startup.^[28]

Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.^[29]

Winnti Group used a rootkit to modify typical server functionality.^[30]

Zeroaccess is a kernel-mode rootkit.^[31]