Bendik Hagen
2026
Rootkits in the Wild: From Derusbi to Demodex
Rootkits have been used since the 2000s by state-sponsored threat actors to enable covert network operations and hide from defenders. Derusbi, as one of the most prominent rootkits of the 2010s, was favoured among many of the well-known China-based groups of the time for its key functionality and capabilities remaining effective over years of operational usage.
Entering the 2020s, rootkits remain a key capability by modern threat actors to hide from defenders with as seen with the emergence of Demodex used by multiple China-based threat actors to enable global espionage campaigns. This talk goes into modern rootkit capabilities in the Demodex rootkit family, and a notable overlap seen with Derusbi displaying malware tradecraft evolving over time.
About Bendik Hagen
Bendik Hagen is a senior threat intelligence analyst at Microsoft, focusing on threat actors from the south east Asia region with a pertinence to malware and infrastructure tracking. Bendik focuses his expertise on threats to telecommunications and critical infrastructure. Prior to joining Microsoft, Bendik worked for the PwC threat intelligence team and the Norwegian government.
