Tool
tool:kernel_implant
Also: implant
Small ELF binary developed by Sophos to collect files, filesystem activity, surrounding MAC addresses, and other telemetry from specifically targeted threat-actor-controlled firewalls.
Small ELF binary developed by Sophos to collect files, filesystem activity, surrounding MAC addresses, and other telemetry from specifically targeted threat-actor-controlled firewalls.
“we developed a kernel implant in-house”
“it’s a small ELF binary”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DEVELOPED_BY | Sophos | Explicit | 174 |
| outgoing | USES | sinkholing | Derived | 174 |
Kernel implant DEVELOPED_BY Sophos
The kernel implant was built by Sophos engineers and distributed only to selected machines of suspected threat actors.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“the security team decides they’re going to build something that they just call the implant”
Kernel implant USES sinkholing
The implant supported Sophos's broader effort to monitor and investigate malicious infrastructure; the episode separately describes Sophos sinkholing seized domains.
Derived Confidence 68% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”