Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat

Once the malware has infected a machine, it hides itself and any other malware used by the threat actor, making infections very hard to detect. Performing live forensics on an infected machine may not turn anything up since all the file, processes, and network artifacts are hidden by the malware. In addition to the rootkit capability, the malware provides a backdoor for the threat actor to log in as any user on the machine with a hardcoded password and to execute commands with the highest privileges. Since it is extremely evasive, a Symbiote infection is likely to "fly under the radar." In Intezers research, they didn't find enough evidence to determine whether Symbiote is being used in highly targeted or broad attacks.