cymothoa
Stealth backdooring tool
persistenceRed Team
Matches ATT&CK tactic: Persistence ↗
ToolpersistenceredLinuxKali LinuxPlatforms: Linux · Last verified September 6, 2026
Cymothoa is a stealth backdooring tool, that inject backdoor’s shellcode into an existing process. The tool uses the ptrace library (available on nearly all * nix), to manipulate processes and infect them.
Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.
Getting started
Install on Kali Linux with `sudo apt install cymothoa`. See the official Kali tool page and upstream homepage linked above for full usage and configuration details.
