Tunneling Tools File Creation (EarthWorm, ReverseSocks5)

Ethan Andrews@eandrews

•updated May 7, 2026•11•0•885

Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories on Linux systems. This activity has been observed in CVE-2026-0300 exploitation.