# Fake Kernel Threads Hiding Backdoors on Linux Servers and Appliances (StyleSmuggler, Tengu, Cyclops Blink; CVE-2026-75650, CVE-2026-20079)

> Eclypsium documents Linux malware that masquerades as kernel threads (spoofed argv[0] and prctl(PR_SET_NAME) names such as [kworker/u:8:0]) to hide backdoors on servers, routers, embedded devices and appliances. 2026 cases include the StyleSmuggler Rust backdoor deployed via the Magento/Adobe Commerce zero-day CVE-2026-75650, the Tengu Mirai-derived bot, a Go C2 agent on an OpenCart store, and a Cyclops Blink variant (UAT-11823, Sandworm overlap) on Cisco Secure Firewall Management Center via CVE-2026-20079.

- **Published:** 2026-10-20T16:25:54Z
- **Last reviewed:** 2026-10-20T16:25:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3971
- **ID:** TL-2026-3971
- **Severity:** CRITICAL (CVSS 10)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-75650, CVE-2026-20079, CVE-2026-20316

## Description

Eclypsium (published 2026-10-20) describes a recurring Linux defense-evasion pattern: user-space implants rename themselves to look like kernel worker threads so they blend into ps/top output. Two mechanisms are used: overwriting argv[0], which changes what `ps aux` and /proc/PID/cmdline show, and prctl(PR_SET_NAME), which changes the short name in /proc/PID/comm. The behaviour maps to MITRE ATT&CK T1036.004 (Masquerade Task or Service). Real kernel threads have PPID 2 (kthreadd), an empty cmdline, an unresolvable /proc/PID/exe, zero VSZ/RSS, the PF_KTHREAD flag, never own network sockets, run as root, and never contain a literal '[' in /proc/PID/comm. Impostors typically have a different parent, a resolvable (or '(deleted)') exe link, non-zero memory, open sockets, and often a non-root owner.

StyleSmuggler (CVE-2026-75650, CVSS 10.0): an unauthenticated RCE in Adobe Commerce 2.4.4-2.4.9 and Magento Open Source (2.4.6-2.4.9 per Akamai) that Sansec observed being exploited from 2026-09-04. Stage 1 poisons a Magento report/log file by POSTing PHP in the query string to /paypal/transparent/response/ (Magento writes var/report/<sha256>; variants poison var/log/system.log or exception.log). Stage 2 POSTs to /graphql with gadget-chain parameters (styles[generatorClass]=Aws\S3\S3Client) so the poisoned file is executed while Magento renders the 'Payment Transaction Failed Reminder' email. The payload is a Rust ELF backdoor first named [kworker/u:8:0] (a malformed kworker name), then fc-cache (v2.1.4, Sept 6) and chronyd (v2.1.5, Sept 7). It connects to 99.84.67.186:443 over WebSocket/TLS and beacons every 60 seconds using spoofed NTP traffic on UDP/123 to ntp.timesync.to / ntp.timesysnc.net with fallbacks ntp.synctime.to / ntp.syncstime.to. The chronyd variant checks TracerPid in /proc/self/status to avoid beaconing under a debugger. Persistence is via cron (twice-hourly restarts) and hidden directories such as ~/.cache/fontconfig/, ~/.local/share/.gvfsd/ and /tmp/.chrony-<8hex>/. A second actor used a 485-byte PHP dropper writing web shells to pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php (gated by an X-Cache-Token header), dropped gs-netcat as pub/defunct, deployed a 'WraithC2' RAT using process aliases 'sshd: apache@notty', '-bash' and '[kworker/u16:2]' (HTTP beacon /a9f3k2-c2 to 213.111.146.27), and modified vendor/magento/framework/App/View.php for remote file inclusion triggered by the cookie gl_google_advisor_824808. Adobe shipped hotfix APSB26-146 (VULN-39341) on 2026-09-07.

OpenCart Go C2 agent (reported 2026-07-03 by K.K. Bourdakos): over a 21-minute window (04:07-04:28 UTC) the attacker deployed a header-driven PHP web shell (catalog/controller/api/api.php, hex-encoded PHP in the TUP header, create_function execution, mtime forged to 2019-10-15), an unauthenticated order-table export endpoint (catalog/controller/common/reload.php), and a statically linked 5.6 MB Go ELF 'watchdogd' (/home/user/watchdog/.runtime/watchdogd) that renamed itself to [kworker/7:2] via prctl(PR_SET_NAME). It provides an HTTP/2 client, WebSocket and SOCKS5 proxying over TLS, runs as the hosting user with 724 MB VSZ / 12 MB RSS in state Sl, and persists with an @reboot cron entry plus a five-minute pgrep-based respawn job.

Tengu (Mirai-derived, reported by Reverser.Space): a stripped, statically linked 32-bit Linux ELF that uses a randomized kworker/%d:%d name, persists via a fake systemd service ('System Helper Service'), SysV init and rc scripts, OpenWrt procd, @reboot cron, /etc/rc.local and shell startup files, marks its binary immutable, uses the hardware watchdog to reboot the device when its process is killed, and provides UDP/datagram floods, SSH handshake and HTTP request floods and proxy relaying.

Cyclops Blink on Cisco FMC: Cisco Talos tracks three clusters exploiting CVE-2026-20079 (CVSS 10.0 authentication bypass giving root script execution on Secure FMC) and CVE-2026-20316 (CVSS 5.3 static credentials). UAT-12197 deployed a JSP web shell (home.jsp) and Java command executor (cmd.jar) and extracted database credentials with OmniQuery.pl. UAT-11823, which overlaps with Sandworm tooling, persisted via a modified license.tmp Makeself package executed through package_info.pl, spawned a netcat reverse shell and deployed a Cyclops Blink ELF implant (DoH resolution, file transfer, credential harvesting, command execution, network scanning, packet sniffing). UAT-11988, linked to Qilin ransomware, used CVE-2026-20316, SOCKS5 and reverse-SSH tunnelling, Impacket, Invoke-TheHash and AV killers before ransomware deployment. Eclypsium notes the Cyclops Blink variant's kernel-thread masquerading is unconfirmed; original Cyclops Blink used /etc/init.d scripts (NCSC, Feb 2022). Eclypsium also cites Trend Micro's Linux Noodle RAT, used by Chinese-speaking groups after web shell access, as using spoofed process names.

Detection engineering should flag any process whose comm/args claim a kernel-thread name but that has PPID != 2, a resolvable /proc/PID/exe, non-zero VSZ/RSS, a literal '[' in comm, non-root ownership, or network sockets. Elastic publishes a kthreadd masquerading detection rule.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1053.003 Cron
- T1543.002 Systemd Service
- T1037.004 RC Scripts
- T1036.004 Masquerade Task or Service
- T1070.006 Timestomp
- T1564.001 Hidden Files and Directories
- T1059.004 Unix Shell
- T1071.001 Web Protocols
- T1095 Non-Application Layer Protocol
- T1090 Proxy
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1046 Network Service Discovery

## Sources

- [Fake Kernel Threads Are Hiding Backdoors on Linux Servers and Appliances](https://eclypsium.com/blog/linux-malware-fake-kernel-threads/)
- [StyleSmuggler 0-day (CVE-2026-75650) - Sansec](https://sansec.io/research/stylesmuggler-0day)
- [Cisco Talos: Ongoing exploitation of Cisco Secure FMC](https://blog.talosintelligence.com/fmc-ongoing-exploitation)
- [Adobe Security Bulletin APSB26-146](https://helpx.adobe.com/security/products/magento/apsb26-146.html)
- [Ghost process: Go C2 agent in an OpenCart breach - K.K. Bourdakos](https://kbourdakos.gr/articles/ghost-process-go-c2-agent-opencart-breach.html)
- [NCSC Malware Analysis Report: Cyclops Blink](https://ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cyclops-blink/NCSC-MAR-Cyclops-Blink.pdf)
- [Trend Micro: Noodle RAT - reviewing the new backdoor used by Chinese-speaking groups](https://www.trendmicro.com/en_us/research/24/f/noodle-rat-reviewing-the-new-backdoor-used-by-chinese-speaking-g.html)
- [Akamai: CVE-2026-75650 StyleSmuggler Adobe Commerce / Magento](https://www.akamai.com/blog/security-research/2026/sep/cve-2026-75650-stylesmuggler-adobe-commerce-magento)
- [The Hacker News: Adobe patches Magento zero-day](https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html)
- [The Hacker News: Tengu botnet reboots compromised Linux devices](https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html)
- [Hive Pro: Tengu, the Mirai fork with a resurrection clause](https://www.hivepro.com/threat-advisory/tengu-the-mirai-fork-with-a-resurrection-clause)
- [BleepingComputer: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers](https://www.bleepingcomputer.com/news/security/cisco-fmc-flaws-exploited-by-ransomware-gang-state-sponsored-hackers/)
- [SecurityWeek: Organizations warned of Cisco Secure FMC exploitation](https://securityweek.com/organizations-warned-of-cisco-secure-fmc-exploitation)
- [Elastic detection rule: kthreadd masquerading](https://detection.fyi/elastic/detection-rules/linux/defense_evasion_kthreadd_masquerading/)
- [NVD CVE-2026-75650](https://nvd.nist.gov/vuln/detail/CVE-2026-75650)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3971