There are many directions one could go with this but as a starting point: Are these hidden in lsof -n, ss -emoainp and in /proc/net/tcp ? Are you able to see

There are many directions one could go with this but as a starting point: Are these hidden in lsof -n, ss -emoainp and in /proc/net/tcp ? Are you able to see the associated inodes in ss or lsof? If you boot up on a live / diskless / ram-only / rescue ISO do you see the same things? I would also suggest downloading the ISO and creating the thumb drive on a different machine if that is an option and don't insert thumb drive into suspect machine until it is powered off. Some distributions have a package command that can validate signatures and checksums of all the binaries. Mount the suspect disk read-only and chroot to it to run this command and save output to ram. Dont validate packages from the live running suspect image as GPG keys can be inserted by an attacker. [1] may be a starting point Before you nuke whatever is doing this, can you capture the output of this to a thumb drive assuming tcpdump is not patched? I'm 30% into my first coffee so please forgive me if I miss something obvious. Don't have any applications open when capturing this. Close the browser. # cooked (all) interfaces, no resolution, epoch, verbose, full packet, 4000 packets, write to shared mem tcpdump -i any -NNnnttvv -s0 -c4000 -w /dev/shm/cap.cap cp /dev/shm/cap.cap /wherever/you/mounted/thumbdrive/ It may be worth validating the path of tcpdump and saving all your current live variables and saving that to a thumb drive. Use objdump -p on any suspect binaries. env > /dev/shm/env.txt # esp look for any LD_ anything which -a tcpdump objdump -p $(which tcpdump) > /dev/shm/tcpdump_objdump.txt Most important probably would be to sanitize anything sensitive prior to sharing with anyone on the internet via a paste site or github or whatever is easiest. Feel free to push files into sftp share@ohblog.net in /pub/ (no pw) [1] - https://help.ubuntu.com/community/SecureApt https://help.ubuntu.com/community/SecureApt [should apply to mint, I think]