Based on the provided information, here's a summary and analysis of OrBit's evolution from 2023 to 2025:
Evolution Overview
-
Lineage A (Full Capabilities)
- 2023: Full capabilities with 66 exports and 54 hooks.
- 2024: Key rotation to 0xAA, reduced feature set in some variants.
- 2025: Return to 0xA2 key, introduction of new PAM hook (pam_sm_authenticate).
-
Lineage B (Lite Capabilities)
- 2023-2025: Continues with a reduced capability set (64/66 exports and 49 hooks), no PAM or pcap interception, no TCP port hiding.
Key Developments
Lineage A
-
Key Rotation in 2024:
- Transitioned to 0xAA key for a short period.
- Reverted back to 0xA2 by 2025.
-
Feature Set Adjustments:
- In 2024, some variants had
Read the full article at Malware Analysis, News and Indicators - Latest topics
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.





