ClientKing in-memory Linux kernel module load without on-disk .ko or via memfd

Duo Tech@duotech

•updated Aug 14, 2026•0•0•1

Detects ClientKing's technique of loading Linux kernel modules directly from memory (via memfd/init_module) without a corresponding on-disk .ko file, used to deploy rootkit functionality.