{
  "family": "reptile",
  "sample_count": 13,
  "category": "rootkit",
  "description": "Reptile (widely tracked across threat intelligence feeds as Rootkit.Reptile and Backdoor.Reptile) is a powerful, open-source stealth kernel-mode rootkit and backdoor framework created by researcher f0rb1dd3n and widely weaponized by sophisticated state-sponsored and cybercrime threat actors. Designed to provide deep persistence and concealment, Reptile operates as a Loadable Kernel Module (LKM) or Windows kernel driver that hooks system call tables, IRP handlers, and process management routines. It completely hides selected processes, network connections, ports, and files from operating system utilities, while providing an encrypted ICMP/UDP port-knocking reverse shell backdoor that activates on demand.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Rootkit:Linux/Reptile",
    "Backdoor:Linux/Reptile",
    "Rootkit:Win32/Reptile",
    "Reptile LKM Rootkit",
    "Reptile Framework"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Rootkit:Linux/Reptile (Reptile Framework)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Reptile is an advanced kernel-mode rootkit and backdoor framework used to conceal processes, network sockets, and backdoor access."
      }
    },
    {
      "@type": "Question",
      "name": "How does Reptile achieve stealth at the kernel level?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks system call dispatch tables and unlinks data structures to hide files, directories, processes, and network ports from monitoring tools."
      }
    },
    {
      "@type": "Question",
      "name": "How does the port-knocking backdoor in Reptile function?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The kernel driver silently inspects raw network packets, spawning an encrypted reverse root shell only when receiving a secret magic packet."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Reptile widely abused by threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it is an open-source, highly modular, and extremely reliable kernel rootkit framework that bypasses traditional security agents."
      }
    },
    {
      "@type": "Question",
      "name": "How can security defenders detect an active Reptile rootkit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use kernel integrity monitoring tools, perform memory forensics using Volatility, audit loaded kernel modules, and monitor raw network traffic."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1014",
    "T1543.003",
    "T1205.001",
    "T1562.001",
    "T1059.004",
    "T1071"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1547.006",
      "name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions (LKM)",
      "tactic": "Persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit (Kernel Hooking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1205.001",
      "name": "Traffic Signaling: Port Knocking (Hidden Backdoor)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (Required for LKM insertion)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Hiding from EDR)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the compromised server from the network, but do NOT power it down if you intend to perform forensics, as the rootkit resides in volatile kernel memory.",
    "Assume the server is fundamentally compromised. You cannot trust any output from commands run on the live, infected system.",
    "Capture a full memory image (RAM dump) of the Linux server for kernel forensics to identify the hooked functions and extract the attacker's configuration.",
    "The only secure remediation for a Kernel Rootkit infection is a complete wipe and bare-metal reinstall of the operating system. Do not attempt to 'clean' it."
  ],
  "what_to_avoid": [
    "Do not trust the output of `lsmod` (list modules); Reptile is designed to instantly unlink itself from the module list to hide its presence.",
    "Avoid relying on standard file integrity monitoring (FIM) tools running on the infected OS, as the rootkit will intercept their reads and return clean data."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "GitHub - f0rb1dd3n/Reptile LKM Rootkit Repository",
      "url": "https://github.com/f0rb1dd3n/Reptile"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Rootkit:Linux/Reptile",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rootkit:Linux/Reptile"
    },
    {
      "name": "MITRE ATT&CK - Rootkit (T1014)",
      "url": "https://attack.mitre.org/techniques/T1014/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}