PwnKit
PwnKit is a self-contained exploit for CVE-2021-4034 used to achieve local privilege escalation on Linux systems. In the provided reporting, it was deployed post-compromise by multiple intrusion clusters as part of broader intrusion toolchains rather than as an initial access vector. Unit 42 observed Chinese-linked cluster CL-UNK-1068 using PwnKit for Linux privilege escalation during cyberespionage-oriented intrusions targeting high-value organizations across South, Southeast, and East Asia, including government, critical infrastructure, technology, telecommunications, aviation, energy, law enforcement, and pharmaceutical sectors. Unit 42 also reported use of PwnKit by cluster CL-STA-0969 in 2024 against telecommunications providers in Southwest Asia, where the actor likely gained initial access via SSH brute force and then used PwnKit, DirtyCoW, and sudo Baron Samedit for privilege escalation. In that activity, CL-STA-0969 overlapped with activity attributed to Liminal Panda and showed tooling overlaps with Light Basin and several UNC clusters. The content explicitly identifies PwnKit as Linux privilege-escalation tooling and notes that Unit 42 published SHA-256 IOCs for PwnKit among other tools associated with CL-STA-0969.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
“The threat actor used PwnKit, a self-contained exploit for CVE-2021-4034.”
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The threat actor used PwnKit, a self-contained exploit for CVE-2021-4034.”
“Attackers deployed PwnKit, a self-contained exploit (CVE-2021-4034) to achieve local privilege escalation on Linux systems.”
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Local privilege escalation exploit for Linux (polkit pkexec) used to obtain root-level execution.
Local privilege escalation exploit for Polkit pkexec (CVE-2021-4034) used to obtain root on Linux systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.