Matheus Alves has released Singularity, a free, open-source rootkit for Linux systems. Unlike most malware, it’s designed as a research tool to demonstrate kernel-level evasion techniques. It allows remote code execution, disables security features, and hides files and processes, but isn't known to be actively used in attacks.

The rootkit operates by hooking into the kernel's Ftrace mechanism, avoiding traditional detection methods like patching CPU trap vectors. It hides its own presence by removing itself from the kernel module list and blocks subsequent module loading. Its primary function is to maintain an undetected presence after a system has already been compromised.

Singularity hides attacker-controlled processes, their network communications, and associated files. It uses a simple 32-entry array for process IDs and intercepts system calls like `kill()` and `execve()` to add processes to its hidden list. File hiding is complex, filtering directory entries from `getdents()` calls and adjusting filesystem metadata to avoid inconsistencies.