MYRA RAT Fileless Execution via memfd_create and fexecve with systemd-userdbd Masquerade

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects evidence of the MYRA Linux RAT executing payloads filelessly from memory using memfd_create and fexecve. The rule flags suspicious processes masquerading as systemd-userdbd, particularly when spawned from Node.js environments or associated with malicious packages like apintergrationpost or .libcache.so artifacts.