ctipilot.chSwitzerland · Europe · Public sector

QLNX (Quasar Linux) — developer-targeting Linux RAT with eBPF rootkit and PAM backdoor

tool · tool:QLNX

Coverage timeline
1
first 2026-05-07 → last 2026-05-07
Briefs
1
1 distinct
Sources cited
3
3 hosts
Sections touched
1
research
Co-occurring entities
0
no co-occurrence

Story timeline

  1. 2026-05-07CTI Daily Brief — 2026-05-07
    researchFirst coverage. Fileless execution; dynamic LD_PRELOAD and eBPF rootkit compilation on victim; PAM credential harvesting; developer credential harvesting (npm, PyPI, GitHub, cloud providers); supply-chain pivot design.

Where this entity is cited

  • research1

Source distribution

  • bleepingcomputer.com1 (33%)
  • securityweek.com1 (33%)
  • trendmicro.com1 (33%)

Items in briefs about QLNX (Quasar Linux) — developer-targeting Linux RAT with eBPF rootkit and PAM backdoor

No parsed item heading or body matches this entity yet. Items match by exact CVE id (for CVE entities), by lead-segment substring of the title in the item heading or body, or by a distinctive anchor token from the title appearing in the item heading. Coverage that lives inside a broader section (no per-item heading) is captured by the Story timeline above.