MYRA Linux RAT LD_PRELOAD Hijack via .libcache.so Masquerading as systemd-userdbd

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•8

Detects persistence mechanisms associated with the MYRA Linux RAT, including malicious library injection via LD_PRELOAD using /usr/local/lib/.libcache.so, creation of persistence scripts in /etc/profile.d/, and process masquerading where a process executes as 'systemd-userdbd' but is not launched by the legitimate systemd manager.