Linux Process Masquerading as Systemd-Logind

Tim Peck@timpeck

•updated Dec 3, 2025•3•1•95

Detects a process executing from a temporary directory that masquerades as the legitimate 'systemd-logind' service. This behavior is characteristic of the V3G4 Mirai-derived botnet, which uses this technique to evade detection.