"Userland" as opposite of "kernelland". I only had a quick skim of the article, but there doesn't seem to be any kernel module loaded by this rootkit. Hence, an

"Userland" as opposite of "kernelland". I only had a quick skim of the article, but there doesn't seem to be any kernel module loaded by this rootkit. Hence, an userland rootkit, because everything happens outside of kernel.