HOMETHREATSTripleCross
MALWARE FAMILY

TripleCross

Internal ID: elf.triplecross
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to its author, TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology.

Threat Analysis

TripleCross is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://github.com/h3xduck/TripleCross
→https://lolcads.github.io/posts/2023/12/bpf_memory_forensics_with_volatility3/

Quick Facts

TypeMalware Family
Aliases1

Also Known As

elf.triplecross

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search TripleCross
TripleCross — Malware Family | Threat Intelligence | CTIWATCH.COM