REPTILE

AV

Description

REPTILE is an open source Linux rootkit with multiple components that provides backdoor access and functionality on compromised hosts.

Stats

First seen: July 2023
Last seen: October 2026

MITRE ATT&CK techniques

11 techniques across 4 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.004Unix Shell

TA0003 Persistence

T1543Create or Modify System Process
- T1543.004Launch Daemon
T1546Event Triggered Execution
- T1546.017Udev Rules
T1547Boot or Logon Autostart Execution
- T1547.006Kernel Modules and Extensions

TA0005 Stealth

T1014Rootkit
T1140Deobfuscate/Decode Files or Information
T1205Traffic Signaling
- T1205.001Port Knocking
T1205Traffic Signaling
- T1205.001Port Knocking
T1564Hide Artifacts
- T1564.001Hidden Files and Directories

TA0011 Command and Control

T1095Non-Application Layer Protocol
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

Associated groups

G1048UNC3886

Associated campaigns

C0056RedPenguin

Alert name variants

Alert Name	Engine
Gen:Variant.Linux.Reptile.1	AV
Gen:Variant.Trojan.Linux.Reptile.1	AV

Related families

Uroburos Skidmap BRICKSTORM Bundlore Clambling

References