GICT knowledge base
Watch Out for the "Rondo" Rootkit
Published
Is Your Server Acting Strange? and killing processes? Watch Out for the “Rondo” Rootkit
Some root kits sit silent. The Rondo root kit makes itself known because commands show killed right away like top / ps and pstree
We are currently seeing a rootkit that is nasty for one specific reason: it kills your monitoring tools.
TLDR: Infections point to two areas.
1) weak root password, ssh allowing root logins. Ensure you have a strong root password. Consider adding fail2ban or some brute force protection for ssh. Secure ssh with keys only, no password, and consider disallowing ssh as root
2) NodeJS running as root, with security issues. Apps may have security issues over time, but isolating them as a user is the best practice. If you are running nodejs, run it as a non root user. While this doesn’t prevent a security issue in nodejs, it will prevent modifying system files that may include downloading software, installing and ssh key and gaining root access.
The Main Symptom: Killing commands like top
If you are a server admin, you probably use the command top or pstree to see what programs are running. If you have this infection, those commands will instantly be killed
A preload in /etc/ld.so.preload is loaded which runs a binary first to prevent certain processes.
Where the Malware Hides
If you suspect your server is infected, here are the specific locations and files you need to look for.
1. The Startup Command (Cron)
This malware wants to ensure it starts up every time you reboot your computer. It often hides a command in your scheduled tasks.
Check /etc/crontab. You may see a line that looks like this:
@reboot /etc/rondo/rondo react.x86_64.persisted
You might also find a rogue file located at /etc/cron.d/rando.
2. The Invisibility Cloak (Preload)
This is the most dangerous part. The virus uses a feature called “preloading” to inject itself into every single program you run. This is how it stays hidden.
Check the file /etc/ld.so.preload. If you see the following file inside it, you are likely infected:
/etc/data/libsystem.so
3. Other Suspicious Files
This rootkit leaves files scattered all over the system to ensure it stays alive. If you see these files, they are part of the infection:
/tmp/runnv/lived.sh/etc/systemd/system/systemd-utils.service/etc/systemd/system/lived.service/etc/systemd/system/system-sysinit.service/etc/systemd/system/system-update-service.service/usr/sbin/wsystemd/root/.systemd-utils/etc/init.d/rondo/etc/data/curl
The Secret Backdoor
Finally, hackers often create a “backdoor” so they can log in as an root whenever they want, even if you change your password.
Check your /etc/passwd file. Look for strange user accounts that have the ID “0” (which means admin/root) but are not named root.
How to Fix It
Removing a rootkit is possible but defer to the experts
Recommendation:
- Expert Help: If you are an InterServer customer, contact support immediately. Staff can check your VPS and assist with cleaning this specific infection.
- The Nuclear Option: The safest way to be 100% sure the virus is gone is to back up your data (carefully!) and perform a full reinstall of the operating system.