1 min read

How Linux Malware Works, From Simple to Sophisticated

Craig Rowland, Founder and CEO, Sandfly Security : Published Updated

Videos Malware Linux Security Presentations Webinar
How Linux Malware Works, From Simple to Sophisticated

Publication Date: 17 June 2026

This presentation was given by Sandfly Security’s CEO, Craig Rowland, at an invite only conference at Ericsson headquarters in Stockholm for telecommunications and mission critical infrastructure providers.

We cover Linux threats from noisy cryptominers, command and control (C2) frameworks, and network implants like BPFDoor. Plus, we discuss Pluggable Authentication Module (PAM) password stealing backdoors, SSH credential theft, as well as stealth rootkits. You'll learn how these various attacks work and why some are much more difficult to detect. By the end of the video you’ll know what these Linux attack categories are, why they are a threat, and when attackers may deploy them.

From cloud servers to embedded devices, Sandfly hunts Linux threats agentlessly. We find BPFDoor and stealth rootkits, track SSH keys, and identify the weak passwords that make compromise possible.

 

Next Steps

Download the PDF here.

Contact Ericsson to learn more about agentless Linux security monitoring for critical infrastructure.

To learn more about hunting for Linux stealth rootkits using command line forensics, watch:

 

See Sandfly in your environment. Contact us
Evasive Linux Malware and Backdoor Detection Presentation

Evasive Linux Malware and Backdoor Detection Presentation

Sandfly Security - Agentless Linux EDR and Incident Response : 14 November 2023

Evasive Linux malware and backdoor detection presentation featuring BPFDoor and command line forensics.

Videos Malware Linux Security Linux Forensics Education Presentations
Read More
Christchurch HackerCon 2018 Presentation – Insider’s History of Intrusion Detection Technology

Christchurch HackerCon 2018 Presentation – Insider’s History of Intrusion Detection Technology

Sandfly Security - Agentless Linux EDR and Incident Response : 01 November 2018

Sandfly founder Craig Rowland did a presentation on the insider’s history of Intrusion Detection Systems at the Christchurch HackerCon.

Videos Linux Security Linux Forensics Presentations
Read More
Linux Stealth Rootkit Hunting Presentation

Linux Stealth Rootkit Hunting Presentation

Sandfly Security - Agentless Linux EDR and Incident Response : 09 October 2025

Hunting Linux stealth rootkits with command line tools from the Cold Incident Response Conference 2025.

Malware Linux Security Linux Forensics Presentations
Read More