1337_GTWK Linux Kernel Rootkit — AI-Assisted Malware-as-a-Service (elf.1337_gtwk_rootkit) — Threadlinqs Intelligence
As of 2026-08-03, 1337_GTWK Linux Kernel Rootkit — AI-Assisted Malware-as-a-Service (elf.1337_gtwk_rootkit) is a high-severity malware threat attributed to Markas Escobar (Indonesia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1837 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Markas Escobar · Indonesia · FINANCIAL
1337_GTWK (Malpedia: elf.1337_gtwk_rootkit) is a newly cataloged Linux LKM rootkit + user-space agent sold as a Malware-as-a-Service offering, discovered by independent researcher Prtheus. It hooks
1337_GTWK (Malpedia: elf.1337_gtwk_rootkit) is a previously undocumented Linux malware family combining a kernel-mode Loadable Kernel Module (LKM) rootkit with a user-space C2 agent, marketed as a Malware-as-a-Service (MaaS) offering. It was first identified in the wild on 2026-07-27 by independent researcher Prtheus, who published a two-part technical analysis on 2026-07-30 (C2 web panel) and 2026-07-31 (rootkit and agent internals); Malpedia cataloged the family the same day as elf.1337_gtwk_rootkit.
The rootkit (gtwk_module.ko / gtwkmod) is built from modular source files (main.c, infra.c, evasion.c, network.c, protect.c, survival.c, control.c, internal.h) and 'intercepts selected kernel functions and system calls' to hide gtwk_-prefixed files, processes, and network connections — including forcing /proc queries for hidden processes to return ENOENT and filtering directory/process listings so hidden processes are invisible to normal enumeration. It bypasses Netfilter and firewall rules to conceal its own network traffic, and blocks kernel security updates by writing an APT preferences pin (/etc/apt/preferences.d/kernel-lts-pin). For anti-removal, it sets the S_IMMUTABLE filesystem flag on its configuration files and triggers a deliberate kernel panic on any unauthorized attempt to unload the module; safe removal requires first writing the token 'sudo@3306' to the procfs control interface /proc/gtwk_cmd/unlock.
Persistence is achieved by registering the module in /etc/modules-load.d/gtwk_module.conf, storing it at /lib/modules/<kernel>/kernel/drivers/base/gtwk_module.ko, and additionally disguising a systemd drop-in override under /etc/systemd/system/rsyslog.service.d/gtwk_module.conf so the module loads under cover of the legitimate rsyslog service (masquerading). A kernel thread named gtwk_runner acts as a watchdog, checking the user-space agent gtwk_app every five seconds and restarting it if killed.
The user-space agent (gtwk_app) retrieves host information (hostname, IP address), receives and executes arbitrary commands from the C2, uploads/downloads files (the codebase's 'downloadFile' routine is actually an upload from the operator's perspective), captures screenshots, and can re-download the rootkit module to recover from remediation attempts. Internally it identifies its own hidden sockets using the marker 0x4754574B.
The C2 side is a web-based administration panel — branded as an 'Advanced Server Administration Tools & Cyber Security Platform' with mixed English/Indonesian content — offering agent management (hostname, IP, OS, last-seen timestamps), a remote command terminal, file browsing/exfiltration, system-file monitoring, a task queue, and a honeypot-logging feature that captures credentials submitted to the panel. Prtheus found evidence in Google's search cache indicating the platform had been used to compromise at least one website (since remediated). Four dedicated IPv4 addresses serve as C2 infrastructure (109.199.105.207, 109.199.110.80, 169.58.3.197, 217.76.55.116), and 18 SHA256 sample hashes covering rootkit and agent components have been published; none were correlated to existing C2 configurations on BeaconBeagle at time of research.
Attribution is circumstantial and low-confidence: Prtheus's Part 1 analysis attributes the operation to a group/brand referred to as 'Markas Escobar' (Indonesian for 'Escobar's Base/HQ'), and a debug timestamp routine in infra.c manually adds seven hours to UTC (sec + (7 * 3600)), consistent with a UTC+7 (Indonesia) development timezone. Malpedia's entry additionally notes parts of the codebase were 'likely programmed using AI.' No CVE is associated with this threat — it is not a vulnerability — and the initial infection/access vector remains unconfirmed. No public source repository, YARA rule, or additional independent vendor reporting exists as of this analysis; the only corroborating sources are Prtheus's two articles and the resulting Malpedia catalog entry.
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1059.004, T1547.006, T1543.002, T1014, T1036.004, T1564.001, T1222.002, T1686, T1490, T1082
