Threat video1:00
Linux Kernel Bugs, Falcon C2, GSocket: Detection & IOCs
CVE-2026-64563 gives local root on Linux and Android; Falcon C2 and GSocket add 27 IOCs and 9 detection rules, incl. a free Splunk SPL rule.
Read the full threat intel for ThreatsDay Roundup: Microsoft MDASH Linux Kernel Bugs… →
Chapters
- 0:00The hookLab exploits gave root on 8 Linux CVEs.
- 0:04The storyMicrosoft's AI pipeline scanned some kernel subsystems.
- 0:12Attack pathUnit 42 says Falcon runs JavaScript in browsers.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise23 indicators to hunt: 1 IP, 8 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques20 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation5 steps now: Apply Linux kernel updates containing the upstream rhashtable fix.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Lab exploits gave root on 8 Linux CVEs.
0:05Microsoft's AI pipeline scanned some kernel subsystems.
0:09It yielded 59 upstream reports.
0:13Unit 42 says Falcon runs JavaScript in browsers.
0:17It harvested logins, cookies, then hijacked sessions.
0:20Antino, a Rust implant, beacons via OneDrive.
0:27No threat actor is attributed. Confidence: low.
0:3123 indicators to hunt: 1 IP, 8 domains and 1 URL, and more.
0:3820 ATT&CK techniques, from initial access to command and control.
0:435 steps now: Apply Linux kernel updates containing the upstream rhashtable fix.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.