CurlRAT Root Reverse Shell Spawn via setuid(0) from Trojanized Daemon

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•0

Detects the specific execution pattern associated with CurlRAT, where common Linux daemons (crond, atd, agetty, polkitd) perform an outbound network connection and subsequently spawn an interactive shell (sh, bash, dash) as the root user within a 5-minute window.