Suspicious ld-unix.so.2 Cron Persistence

Elgonad .@elgonad

•updated Apr 14, 2026•4•0•315

Detects the creation of crontab entries executing a payload masquerading as a legitimate Linux dynamic linker (ld-unix.so.2). Masjesu uses this highly specific path and filename combination to disguise its primary persistence mechanism.