Claim

TStark USES libxselinux.so

TStark was observed developing and using the libxselinux.so userland rootkit on a threat-actor device.

Episode
EP 174 — Pacific Rim
Origin
Explicit
Confidence
99% (extractor score, not a fact score)
Speaker
Craig Jones
Attributed source
—

Transcript evidence

“We found him working on a rootkit at the time. It was called libxselinux.so”

Craig Jones · offsets 67504–67579

Read the official transcript

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:59:46.082354+00:00

claim:ep174:29278dd870ef