Tomcat Kernel Backdoor Host Activity

Jamari Donovan@JDtheHiddenOne

•updated Aug 25, 2025•1•1•21

Detects host-based artifacts of the Tomcat remote Kernel Backdoor, specifically the communication between the LKM and the userland component via the /proc/acpi/pcicard file.