MYRA Linux RAT delivery via malicious npm package apintergrationpost

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

This rule detects the presence of components associated with the MYRA rootkit, including specific filenames ('libcache.so', 'memfd_loader') and references to the 'apintergrationpost' npm package or the author 'kimijohn01'. It monitors process command lines, file events, and syslog messages for these indicators.