Storm Cloud
0001-01-01
Storm Cloud (aka Makers Mark/MM) is a cyberespionage operation related to Moonlight Maze that mentions the use of LOKI2.
The article mentioning Storm Cloud is titled “Net Espionage Rekindles Tensions As U.S. Tries to Identify Hackers” and is paywalled.
https://www.wsj.com/articles/SB993588688215931869
Linux Persistence: Modular Software
2025-04-17 DFIR CTF persistence linux persistence apache asterisk
Linux Persistence: Web Shells
2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP
Linux Persistence: Rootkits
2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking
Defanging Linux LKM Rootkits With cleanup_module()
2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit