Product

The stealthy Linux threat, and what Zero Door sees

Some threats do not attack a server from the outside; they move in. One example is Symbiote, a parasitic Linux malware first reported in mid-2022: it integrates directly into the operating environment and hides in plain sight.

This post explains what makes Symbiote hard to see, how it operates, and what Zero Door shows when a threat like it lands on a server.

What Is The Symbiote?

First discovered by Joakim Kennedy and the BlackBerry Threat Research team, Symbiote is a userland rootkit specifically designed for Linux systems. Drawing its name from biology, a symbiote thrives inside a host. This malware similarly embeds itself into all running processes by hijacking system behavior.

Unlike traditional malware, Symbiote is not a standalone binary. It is a shared object (.so) library injected via the LD_PRELOAD environment variable. This technique enables it to load before other libraries and override standard system functions, making it invisible to even experienced administrators.

Once inside, Symbiote:

  • Hooks function like execve, readdir(), pcap_loop(), and pam_authenticate()
  • Alter the file and process listings
  • Intercepts credentials and keystrokes
  • Masks network activity from packet capture tools

This isn’t just stealth, it’s calculated deception.

Symbiote’s Multi-Pronged Capabilities

  • Process and File Stealth: Removes traces from ps, ls, and ldd outputs. Hijacks readdir() to hide in /proc, making itself invisible.
  • Network Traffic Manipulation: Hooks pcap_loop() and pcap_stats() to block malicious packets and fake traffic statistics.
  • Encrypted C2 Communication: Uses RC4 encryption to disguise traffic and hardcoded strings.
  • Credential Theft: Intercepts PAM calls to steal passwords and supports backdoor access via a hardcoded credential (suporte42cbb32).
  • Script Execution: Downloads and runs bash scripts from dev21[.]bancodobrasil[.]dev without leaving traces.
  • Keylogging: Hooks read() to capture SSH/SCP keystrokes, writing them to /usr/include/certbot.h and exfiltrating via DNS.

Symbiote is a modular cyber-espionage platform engineered for persistence and invisibility.

Why Traditional Tools Fall Short

Symbiote does not need to slip past a tool that runs on the same host: it runs inside it. It uses legitimate system interfaces, and once ps, ls and ldd load its library, their output is already filtered. Anything that asks the infected host about itself gets an edited answer.

It doesn’t just exploit vulnerabilities; it exploits trust.

That is the question Zero Door is built around: not what the host says about a file, but whether the file is the original.

What Zero Door sees

Zero Door does not trust a file because it is already on the host. It weighs what is on disk against the original, using a legitimacy database read from outside the host, and records who changed what.

What a Symbiote infection leaves behind for Zero Door to find

  1. 01A library with no original. The injected .so is a file on disk that no package shipped, and the legitimacy database does not know it. A library nobody can account for is raised, not folded away with routine change.
  2. 02A write to /etc/ld.so.preload. The preload file is one of the paths the agent watches directly, and a package update cannot explain a change to it away.
  3. 03Files that should not change. Symbiote writes captured keystrokes to /usr/include/certbot.h, a directory that belongs to packages. A new or changed file there is reported with the process that wrote it.
  4. 04The chain behind the change. The alert carries the user who logged in, still known after sudo, and every process with its command line between that login and the write.
  5. What Zero Door doesZero Door detects, explains and records. It does not block the library or kill the process: that decision stays with your responders, with the evidence in front of them.
What a Symbiote infection leaves behind for Zero Door to find, and what Zero Door does with it.

The bigger picture

Symbiote proves that attackers no longer storm the gates if they quietly embed themselves within. It’s not enough to protect the perimeter; organizations must question everything that happens inside their infrastructure.

Zero Door answers that question without asking the infected host to vouch for itself: which binaries, libraries and packages are not the original, and who changed them.

Final Thoughts

Symbiote is a reminder that a host cannot be asked to vouch for itself. Its stealth works against every tool that trusts the host’s own answers.

With Zero Door, defenders get an answer that does not come from the infected host, and a record they can hand to an auditor.

For the malware itself, read our technical analysis: Inside Symbiote: malware deep dive.