H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

A Linux rootkit that provides backdoor access and hides from defenders.

Labels

malware

5 recorded

Relationships

uses

to Local Accounts

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Rootkit

Technique

uses

to Traffic Signaling

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0221

open

Umbreon

—

Umbreon Trend Micro

https://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/?_ga=2.180041126.367598458.1505420282-1759340220.1502477046

open