Threat reportMalwareTL-2026-3971
Fake Kernel Threads Hiding Backdoors on Linux Servers and Appliances (StyleSmuggler, Tengu, Cyclops Blink; CVE-2026-75650, CVE-2026-20079)
Fake Kernel Threads Hiding Backdoors on Linux Servers and (TL-2026-3971), also tracked as StyleSmuggler, is a critical-severity malware campaign scored CVSS 10, first published 2026-10-20. It has no confirmed attribution, affects Adobe Adobe Commerce / Adobe Commerce B2B, references 3 CVEs (CVE-2026-75650, CVE-2026-20079, CVE-2026-20316), maps to 15 MITRE ATT&CK techniques (T1036.004, T1037.004, T1046), and is covered by 9 detection rules and 29 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-3971
- Threat ID
- TL-2026-3971
- Also known as
- StyleSmuggler, Fake kernel threads, Kernel thread masquerading
- Severity
- CRITICAL
- CVSS
- 10
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- retail, ecommerce, telecoms, government administration, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Fake Kernel Threads Hiding Backdoors on Linux Servers and
Malware and tooling: Cyclops Blink, StyleSmuggler backdoor, tengu, Netcat
How Fake Kernel Threads Hiding Backdoors on Linux Servers and works
Eclypsium documents Linux malware that masquerades as kernel threads (spoofed argv[0] and prctl(PR_SET_NAME) names such as [kworker/u:8:0]) to hide backdoors on servers, routers, embedded devices and appliances. 2026 cases include the StyleSmuggler Rust backdoor deployed via the Magento/Adobe Commerce zero-day CVE-2026-75650, the Tengu Mirai-derived bot, a Go C2 agent on an OpenCart store, and a Cyclops Blink variant (UAT-11823, Sandworm overlap) on Cisco Secure Firewall Management Center via CVE-2026-20079.
Eclypsium (published 2026-10-20) describes a recurring Linux defense-evasion pattern: user-space implants rename themselves to look like kernel worker threads so they blend into ps/top output. Two mechanisms are used: overwriting argv[0], which changes what `ps aux` and /proc/PID/cmdline show, and prctl(PR_SET_NAME), which changes the short name in /proc/PID/comm. The behaviour maps to MITRE ATT&CK T1036.004 (Masquerade Task or Service). Real kernel threads have PPID 2 (kthreadd), an empty cmdline, an unresolvable /proc/PID/exe, zero VSZ/RSS, the PF_KTHREAD flag, never own network sockets, run as root, and never contain a literal '[' in /proc/PID/comm. Impostors typically have a different parent, a resolvable (or '(deleted)') exe link, non-zero memory, open sockets, and often a non-root owner.
StyleSmuggler (CVE-2026-75650, CVSS 10.0): an unauthenticated RCE in Adobe Commerce 2.4.4-2.4.9 and Magento Open Source (2.4.6-2.4.9 per Akamai) that Sansec observed being exploited from 2026-09-04. Stage 1 poisons a Magento report/log file by POSTing PHP in the query string to /paypal/transparent/response/ (Magento writes var/report/<sha256>; variants poison var/log/system.log or exception.log). Stage 2 POSTs to /graphql with gadget-chain parameters (styles[generatorClass]=Aws\S3\S3Client) so the poisoned file is executed while Magento renders the 'Payment Transaction Failed Reminder' email. The payload is a Rust ELF backdoor first named [kworker/u:8:0] (a malformed kworker name), then fc-cache (v2.1.4, Sept 6) and chronyd (v2.1.5, Sept 7). It connects to 99.84.67.186:443 over WebSocket/TLS and beacons every 60 seconds using spoofed NTP traffic on UDP/123 to ntp.timesync.to / ntp.timesysnc.net with fallbacks ntp.synctime.to / ntp.syncstime.to. The chronyd variant checks TracerPid in /proc/self/status to avoid beaconing under a debugger. Persistence is via cron (twice-hourly restarts) and hidden directories such as ~/.cache/fontconfig/, ~/.local/share/.gvfsd/ and /tmp/.chrony-<8hex>/. A second actor used a 485-byte PHP dropper writing web shells to pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php (gated by an X-Cache-Token header), dropped gs-netcat as pub/defunct, deployed a 'WraithC2' RAT using process aliases 'sshd: apache@notty', '-bash' and '[kworker/u16:2]' (HTTP beacon /a9f3k2-c2 to 213.111.146.27), and modified vendor/magento/framework/App/View.php for remote file inclusion triggered by the cookie gl_google_advisor_824808. Adobe shipped hotfix APSB26-146 (VULN-39341) on 2026-09-07.
OpenCart Go C2 agent (reported 2026-07-03 by K.K. Bourdakos): over a 21-minute window (04:07-04:28 UTC) the attacker deployed a header-driven PHP web shell (catalog/controller/api/api.php, hex-encoded PHP in the TUP header, create_function execution, mtime forged to 2019-10-15), an unauthenticated order-table export endpoint (catalog/controller/common/reload.php), and a statically linked 5.6 MB Go ELF 'watchdogd' (/home/user/watchdog/.runtime/watchdogd) that renamed itself to [kworker/7:2] via prctl(PR_SET_NAME). It provides an HTTP/2 client, WebSocket and SOCKS5 proxying over TLS, runs as the hosting user with 724 MB VSZ / 12 MB RSS in state Sl, and persists with an @reboot cron entry plus a five-minute pgrep-based respawn job.
Tengu (Mirai-derived, reported by Reverser.Space): a stripped, statically linked 32-bit Linux ELF that uses a randomized kworker/%d:%d name, persists via a fake systemd service ('System Helper Service'), SysV init and rc scripts, OpenWrt procd, @reboot cron, /etc/rc.local and shell startup files, marks its binary immutable, uses the hardware watchdog to reboot the device when its process is killed, and provides UDP/datagram floods, SSH handshake and HTTP request floods and proxy relaying.
Cyclops Blink on Cisco FMC: Cisco Talos tracks three clusters exploiting CVE-2026-20079 (CVSS 10.0 authentication bypass giving root script execution on Secure FMC) and CVE-2026-20316 (CVSS 5.3 static credentials). UAT-12197 deployed a JSP web shell (home.jsp) and Java command executor (cmd.jar) and extracted database credentials with OmniQuery.pl. UAT-11823, which overlaps with Sandworm tooling, persisted via a modified license.tmp Makeself package executed through package_info.pl, spawned a netcat reverse shell and deployed a Cyclops Blink ELF implant (DoH resolution, file transfer, credential harvesting, command execution, network scanning, packet sniffing). UAT-11988, linked to Qilin ransomware, used CVE-2026-20316, SOCKS5 and reverse-SSH tunnelling, Impacket, Invoke-TheHash and AV killers before ransomware deployment. Eclypsium notes the Cyclops Blink variant's kernel-thread masquerading is unconfirmed; original Cyclops Blink used /etc/init.d scripts (NCSC, Feb 2022). Eclypsium also cites Trend Micro's Linux Noodle RAT, used by Chinese-speaking groups after web shell access, as using spoofed process names.
Detection engineering should flag any process whose comm/args claim a kernel-thread name but that has PPID != 2, a resolvable /proc/PID/exe, non-zero VSZ/RSS, a literal '[' in comm, non-root ownership, or network sockets. Elastic publishes a kthreadd masquerading detection rule.
MITRE ATT&CK techniques used in TL-2026-3971
Defense Evasion
T1036.004 Masquerade Task or Service; T1070.006 Timestomp; T1564.001 Hidden Files and Directories
Persistence
T1037.004 RC Scripts; T1053.003 Cron; T1505.003 Web Shell; T1543.002 Systemd Service
Discovery
T1046 Network Service Discovery
Execution
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1095 Non-Application Layer Protocol; T1219 Remote Access Tools; T1572 Protocol Tunneling
Initial Access
Affected products and versions in Fake Kernel Threads Hiding Backdoors on Linux Servers and
- Adobe — Adobe Commerce / Adobe Commerce B2B
Vulnerable versions: 2.4.4 through 2.4.9
Fixed in: APSB26-146 hotfix (VULN-39341) - Adobe — Magento Open Source
Vulnerable versions: 2.4.6 through 2.4.9
Fixed in: APSB26-146 hotfix (VULN-39341) - Cisco — Secure Firewall Management Center (FMC)
Vulnerable versions: Unpatched releases (CVE-2026-20079, CVE-2026-20316)
Fixed in: See Cisco advisory and hardening release of mid-September 2026 - OpenCart — OpenCart storefronts
Vulnerable versions: Compromised store (initial vector not stated) - Various — Linux servers, routers, embedded devices and appliances (Tengu targets)
Vulnerable versions: Devices exposing weak remote access
Remediation for Fake Kernel Threads Hiding Backdoors on Linux Servers and
Patches
- Apply Adobe APSB26-146 (VULN-39341) for CVE-2026-75650
- Apply Cisco fixes for CVE-2026-20079 and CVE-2026-20316 (Secure FMC)
Immediate actions
- Hunt Linux servers and appliances for processes claiming kernel-thread names (kworker, ksoftirqd, kswapd, migration, rcu_) with PPID != 2, resolvable /proc/PID/exe, non-zero VSZ/RSS, non-root owner, literal '[' in comm, or open sockets
- If a fake kernel thread is found, preserve evidence first: copy /proc/PID/exe, review /proc/PID/cwd and /proc/PID/environ, and capture sockets with ss -tunap
- Remove persistence (cron, systemd, init/rc scripts) before killing the process and deleting the binary
- Block the C2 IPs and domains listed in the IOCs at the perimeter and review egress for spoofed NTP (UDP/123) to non-NTP-pool hosts
- For Magento/OpenCart incidents, assume customer and order data exposure
Workarounds
- Apply Cloudflare/Imperva WAF rules for StyleSmuggler where hotfix deployment is delayed (per Sansec)
- Use Cisco Snort SIDs 66075-66080, 66883, 66960 and 66961 for FMC exploitation and malware detection
Longer-term hardening
- Add kernel-thread integrity checks to Linux server and appliance detection engineering
- Inventory network devices and appliances that expose full process listings
- Monitor file birth time versus modify time to catch timestomped web shells
- Deploy WAF rules for the StyleSmuggler request patterns and monitor var/log/exception.log signatures
CVEs associated with Fake Kernel Threads Hiding Backdoors on Linux Servers and
Timeline of Fake Kernel Threads Hiding Backdoors on Linux Servers and
- OpenCart store compromised: PHP web shell and Go C2 agent watchdogd (masquerading as [kworker/7:2]) deployed between 04:07 and 04:28 UTC, per file birth timestamps.
- K.K. Bourdakos publishes analysis of the OpenCart Go C2 agent hiding as a kernel worker thread.
- Sansec records first unsuccessful probes for the Magento/Adobe Commerce StyleSmuggler vulnerability.
- First confirmed exploitation of CVE-2026-75650 (22:20 UTC); Rust backdoor deployed as [kworker/u:8:0].
- Sansec publishes StyleSmuggler research; Sansec Shield blocks attacks from 07:15 UTC.
- StyleSmuggler implant renamed to fc-cache (v2.1.4) with cron persistence.
- Adobe publishes APSB26-146 hotfix (VULN-39341) at 20:20 UTC; implant variant now named chronyd (v2.1.5).
- Cisco Talos reports exploitation of Secure FMC CVE-2026-20079 and CVE-2026-20316 by three clusters, including a Cyclops Blink variant (UAT-11823).
- Cloudflare and Imperva release WAF rules for StyleSmuggler exploitation.
- Eclypsium publishes analysis tying StyleSmuggler, Tengu, the OpenCart Go agent, Noodle RAT and Cyclops Blink to kernel-thread masquerading and offers detection guidance.
Sources cited for Fake Kernel Threads Hiding Backdoors on Linux Servers and
- Fake Kernel Threads Are Hiding Backdoors on Linux Servers and Appliances
- StyleSmuggler 0-day (CVE-2026-75650) - Sansec
- Cisco Talos: Ongoing exploitation of Cisco Secure FMC
- Adobe Security Bulletin APSB26-146
- Ghost process: Go C2 agent in an OpenCart breach - K.K. Bourdakos
- NCSC Malware Analysis Report: Cyclops Blink
- Trend Micro: Noodle RAT - reviewing the new backdoor used by Chinese-speaking groups
- Akamai: CVE-2026-75650 StyleSmuggler Adobe Commerce / Magento
- The Hacker News: Adobe patches Magento zero-day
- The Hacker News: Tengu botnet reboots compromised Linux devices
- Hive Pro: Tengu, the Mirai fork with a resurrection clause
- BleepingComputer: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
- SecurityWeek: Organizations warned of Cisco Secure FMC exploitation
- Elastic detection rule: kthreadd masquerading
- NVD CVE-2026-75650
Detection coverage for TL-2026-3971
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3971 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.