Miasma MYRA RAT LD_PRELOAD Persistence via /usr/local/lib/.libcache.so

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects various methods of establishing persistence on Linux systems by abusing dynamic linker configuration (/etc/ld.so.preload), modifying shell startup profiles (.bashrc, .profile) to include malicious environment variables (LD_PRELOAD/LD_LIBRARY_PATH), or directly launching processes with these hijacked variables pointing to suspicious locations such as /tmp, /dev/shm, or /var/tmp.