PUMAKIT: Hunting a Stealthy Linux LKM Rootkit

A stealthy multi-stage Linux intrusion that ends in a loadable-kernel-module rootkit. A poisoned build-tooling dependency delivered a benign-looking cron dropper to a Linux CI server; the dropper staged its payloads entirely in memory with memfd_create and execveat, loaded an unsigned kernel module that hooks syscalls with ftrace, hid itself behind a magic prefix, side-loaded a userland rootkit over LD_PRELOAD, beaconed over TLS on a non-standard high port, and elevated to root in-kernel through a hooked rmdir magic command. Reconstruct the hunt from Linux SIEM, endpoint XDR, and perimeter firewall telemetry, working from the pre-rootkit dropper records and the network beacon, and classify the key ATT&CK techniques.