Threat reportThreat IntelligenceTL-2026-4359
Linux clear-text credential harvesting techniques (process memory, PAM backdoors, bash history, ptrace tooling)
Linux clear-text credential harvesting techniques (process (TL-2026-4359) is a medium-severity tracked intrusion set, first published 2026-10-24. It has no confirmed attribution, affects Linux Linux servers (PAM, sshd, sudo, /proc), maps to 12 MITRE ATT&CK techniques (T1003.007, T1021.004, T1055.008), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4359
- Threat ID
- TL-2026-4359
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, telecoms, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Linux clear-text credential harvesting techniques (process
Malware and tooling: Decoy Dog RAT, 3snake, pspy, truffleproc
How Linux clear-text credential harvesting techniques (process works
DFIR.ch (Stephan Berger) documents how threat actors collect clear-text passwords on compromised Linux systems via shell history, /proc and process memory, ptrace-based interception (3snake), PAM manipulation, and backdoored edge-device login portals, then use them for lateral movement and cloud pivoting. This is technique-level detection-engineering material, not a single confirmed campaign.
The DFIR.ch article 'Fantastic clear-text passwords and where to collect them (Part 1 - Linux)' (published 2026-06-22) argues that compromised Linux servers are usually pivots rather than final objectives: harvested clear-text secrets are reused for lateral movement, network pivoting and access to cloud tenants such as Azure.
Collection techniques covered: (1) Shell history review (~/.bash_history, /root/.bash_history) - the author cites a real case where a Siemens SCS Groupware keystore password sat in root's history in a keytool -importkeystore command referencing groupware.jks, alongside OpenScape XML config exposing an Azure tenant ID and client ID. (2) Process memory and environment review - /proc/<pid>/environ and truffleproc (github.com/controlplaneio/truffleproc), which attaches with GDB, dumps process memory and scans it for credential patterns. (3) pspy (github.com/DominicBreuker/pspy), which watches process command lines via inotify without root and exposes credentials passed as arguments by cron jobs and automation. (4) ptrace-based interception with 3snake (github.com/blendin/3snake), which intercepts read/write syscalls of sshd, sudo, su, ssh client, passwd and OpenLDAP and listens for process events via netlink; Positive Technologies reported the Hellhounds group using 3snake in Operation Lahat. (5) PAM abuse - native pam_tty_audit.so logging of keystrokes to audit.log, and custom PAM backdoors, often under 100 lines, that write passwords to hidden files while accepting a hardcoded credential. (6) Edge-device portal backdoors - a modified Citrix NetScaler ADC/Gateway login page posts credentials via JavaScript fetch to https://jscloud.live/items/accounts; the article references Volexity's January 2024 Ivanti Connect Secure exploitation research (CVE-2023-46805, CVE-2024-21887, UTA0178), where a modified login script exfiltrated credentials.
Defensive guidance in the source: set kernel.yama.ptrace_scope (1 restricted, 2 admin-only, 3 disabled until reboot) in /etc/sysctl.d/10-ptrace.conf; alert on PTRACE_ATTACH against sshd, sudo, su and passwd unless whitelisted; flag unrecognized binaries spawning children that attach to authentication daemons; use file integrity monitoring on /etc/pam.d/ and PAM .so files; enforce SSH key authentication and disable PasswordAuthentication in sshd_config; set HISTCONTROL=ignorespace; use a secrets manager such as HashiCorp Vault and Entra Conditional Access for workload identities.
No CVE, CVSS or per-incident exploitation confirmation is attributed to the article itself; severity is an analyst estimate.
MITRE ATT&CK techniques used in TL-2026-4359
Credential Access
T1003.007 Proc Filesystem; T1056.001 Keylogging; T1056.003 Web Portal Capture; T1552.001 Credentials In Files; T1552.003 Shell History; T1556.003 Pluggable Authentication Modules
Lateral Movement
Defense Evasion
Privilege Escalation
Discovery
Initial Access
T1078 Valid Accounts; T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application
defense-impairment
T1556.003 Pluggable Authentication Modules
Persistence
Affected products and versions in Linux clear-text credential harvesting techniques (process
Remediation for Linux clear-text credential harvesting techniques (process
Immediate actions
- Alert on PTRACE_ATTACH against sshd, sudo, su and passwd from non-whitelisted processes
- Audit ~/.bash_history and /root/.bash_history for clear-text secrets and rotate any found
- Review /etc/pam.d/ and installed PAM .so modules for unexpected or recently modified files
Workarounds
- Set kernel.yama.ptrace_scope = 1 (or 2/3) in /etc/sysctl.d/10-ptrace.conf
- Set HISTCONTROL=ignorespace and avoid typing secrets in commands
Longer-term hardening
- Enforce SSH key-based authentication and set PasswordAuthentication no in /etc/ssh/sshd_config
- Use a secrets manager (e.g. HashiCorp Vault) instead of passing secrets on command lines or in environment variables
- Deploy file integrity monitoring on /etc/pam.d/ and PAM shared objects with high-priority alerting
- Apply Entra Conditional Access for workload identities to limit reuse of harvested cloud credentials
Weaknesses (CWE) in Linux clear-text credential harvesting techniques (process
Timeline of Linux clear-text credential harvesting techniques (process
- Positive Technologies later reported Hellhounds had been compromising Russian organizations since at least 2021 (month approximate; year per source).
- Earliest suspected UTA0178 activity against Ivanti Connect Secure, including credential harvesting via a modified login script (Volexity).
- Volexity publicly disclosed exploitation of CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN, referenced by the DFIR.ch article for portal credential interception.
- Positive Technologies published Hellhounds: Operation Lahat Part 2, documenting 3snake use for credential harvesting on Linux (date approximate: June 2024).
- Nextron Systems published 'Stealth in 100 Lines' analyzing PAM backdoors in Linux.
- DFIR.ch (Stephan Berger) published 'Fantastic clear-text passwords and where to collect them (Part 1 - Linux)', covering Linux credential collection techniques and defenses.
Sources cited for Linux clear-text credential harvesting techniques (process
- Fantastic clear-text passwords and where to collect them (Part 1 - Linux)
- Volexity: Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN
- Positive Technologies: Hellhounds - Operation Lahat, Part 2
- truffleproc (controlplaneio)
- pspy (DominicBreuker)
- 3snake (blendin)
- Red Hat: Configuring PAM for Auditing (pam_tty_audit)
- Nextron Systems: Stealth in 100 Lines - Analyzing PAM Backdoors in Linux
- AhnLab ASEC: PAM backdoor analysis
- Group-IB: PAM harvesting insight
- Embrace The Red: Post-exploit PAM SSH password grabbing
Detection coverage for TL-2026-4359
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4359 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.