H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Skidmap](https://attack.mitre.org/software/S0468) is a kernel-mode rootkit used for cryptocurrency mining.(Citation: Trend Micro Skidmap)

Labels

malware

16 recorded

Relationships

uses

to Compute Hijacking

Technique

uses

to Cron

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Kernel Modules and Extensions

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Pluggable Authentication Modules

Technique

uses

to Process Discovery

Technique

uses

to Rootkit

Technique

uses

to Security Software Discovery

Technique

uses

to SSH Authorized Keys

Technique

uses

to System Information Discovery

Technique

uses

to Unix Shell

Technique

2 external

References

mitre-attack

S0468

open

Trend Micro Skidmap

https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/

open