Executive Summary
The Syslogk rootkit is a sophisticated Linux kernel-level threat attributed to the Kim Sooki actor group. It is designed to provide deep persistence and stealth by modifying the Linux kernel's execution flow. By leveraging inline hooking and Virtual File System (VFS) table hooking, the rootkit intercepts system calls to hide its presence from standard administrative tools and security monitoring solutions.
Technically, Syslogk targets specific kernel functions such as `proc_root_readdir` and `tcp4_seq_show` to obfuscate processes and TCP communications, respectively. It also manipulates the VFS table to hide files containing specific strings and unlinks itself from the Loadable Kernel Module (LKM) list to avoid detection by commands like `lsmod`. This allows the attacker to maintain a long-term presence on compromised servers without alerting system administrators.
The impact of a Syslogk infection is significant as it undermines the integrity of the operating system's reporting. Standard forensic utilities (e.g., ps, netstat, ls) cannot be trusted on an infected host. Organizations running Linux environments, particularly those in sectors targeted by Kim Sooki, should prioritize kernel-level integrity monitoring and utilize security tools capable of detecting hidden modules and unauthorized memory patches.