TStark USES libxselinux.so
TStark was observed developing and using the libxselinux.so userland rootkit on a threat-actor device.
Explicit Confidence 99% · Craig Jones EP 174 Details
“We found him working on a rootkit at the time. It was called libxselinux.so”