Loading malware…
VoidLink is a sophisticated Linux malware framework designed for long-term, stealthy compromise of cloud and containerized environments. It is a modular command-and-control platform written primarily in Zig and built to operate across Linux servers, containers, and Kubernetes clusters, with environment-aware behavior for major cloud providers and orchestrated workloads. Public reporting describes it as an advanced cloud-native framework with more than 30 post-exploitation plugins and multiple rootkit options spanning userland techniques, Loadable Kernel Modules, and eBPF-based stealth.
VoidLink performs cloud and container reconnaissance, detects whether it is running in Docker or Kubernetes, and adapts module loading to the victim environment. Reported functionality includes harvesting cloud metadata and Kubernetes service account tokens, probing for container escape and Kubernetes privilege-escalation opportunities, and supporting broader post-compromise activity in cloud infrastructure. Its plugin architecture enables in-memory execution of modules, reducing disk artifacts and supporting flexible post-exploitation workflows.
A defining characteristic of VoidLink is its stealth and persistence model. Analyses attribute to it userland hiding via LD_PRELOAD, kernel-level concealment through LKMs, and eBPF-assisted hiding of processes, files, modules, and network connections. Some variants use hybrid LKM and eBPF rootkit designs, including manipulation of Netlink responses to hide connections from standard Linux tooling. Additional evasion features reported for the framework include runtime code encryption, adaptive behavior based on security-tool presence, anti-debugging checks, delayed hook installation, masquerading as legitimate kernel components, self-deletion, and fileless execution using memory-backed loaders.
VoidLink has also been associated with covert command channels and flexible control mechanisms. Reported implementations include modular C2 over conventional network protocols as well as ICMP-based covert control for rootkit operations. Some analyses describe kernel-version-aware deployment logic and server-side compilation of kernel-specific rootkit components to improve portability across Linux distributions and kernel releases.
The framework has been linked in multiple analyses to a Chinese-speaking developer or operator set, based on language artifacts and infrastructure references, although broader attribution should be treated cautiously. VoidLink is notable not only for its technical sophistication but also because it has been widely cited as an early high-profile example of operationally viable AI-assisted malware development, with reporting indicating that a single developer used an AI-enabled development workflow to produce a large, functional codebase in a very short period. The malware primarily targets Linux-based cloud workloads and organizations operating containerized or Kubernetes-backed infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos recently discovered a new threat actor, UAT-9221, leveraging VoidLink in campaigns.
A newly tracked intrusion framework called VoidLink is drawing attention for its modular design and focus on Linux systems. It behaves like an implant management framework, letting operators deploy a core implant and add capabilities as needed...
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Appendix B: Cortex Detections ... T1059.004 - Command and Scripting Interpreter: Unix Shell Run downloaded script using pipe in a Kubernetes pod
The operator interacts with the rootkit through a Python script, icmp_ctl.py, which constructs and sends the ICMP packets using raw sockets.
Finally, load_lkm.sh provided boot-time persistence with a particularly interesting feature: It scanned /proc/*/exe for processes running from memfd file descriptors, a telltale sign of fileless implants.
Finally, load_lkm.sh provided boot-time persistence with a particularly interesting feature: It scanned /proc/*/exe for processes running from memfd file descriptors, a telltale sign of fileless implants.
Elastic Security Labs analyzes VoidLink, a sophisticated Linux malware framework that combines traditional Loadable Kernel Modules with eBPF to maintain persistence.
The rootkit combines a traditional LKM with eBPF programs in a hybrid design... load_lkm.sh provided boot-time persistence... The load_lkm.sh boot script hard-codes a path to /root/kernel5x_new/vl_stealth.ko
The GIVE_ROOT command (0x11) is noteworthy: It takes a target PID as an argument and uses prepare_creds()/commit_creds() to set all UID and GID fields to zero for that process, effectively granting it root privileges without any authentication mechanism.
This isn't theoretical. It's the standard operating procedure for any LKM-based rootkit.
The data field is XOR-encrypted with a single-byte key, 0x42 by default... The v5 variant takes this further by XOR-encrypting the module name string and decoding it at runtime.
Every VoidLink variant disguises its kernel module metadata to impersonate a legitimate AMD driver: MODULE_LICENSE("GPL"); MODULE_AUTHOR("Advanced Micro Devices, Inc."); MODULE_DESCRIPTION("AMD Memory Encryption Support").
One notable detail: The variant suppresses all kernel log output by redefining pr_info, pr_err, and pr_warn as no-ops, a simple but effective anti-forensics measure.
Researchers also documented operational security (OPSEC) features intended to make analysis more difficult, including runtime code encryption, adaptive behavior based on the execution environment, and self-deletion capabilities that can remove components when necessary.
The entire malicious logic exists as transient, encrypted blobs in memory, re-decrypted only when it needs to "beacon" back to the C2 server.
Check Point's analysis revealed VoidLink to be a sophisticated, modular command-and-control framework written in Zig, featuring cloud-environment detection...
When it asks the kernel for a list of active network sockets, it receives the exact same "laundered" data that your shell received.
This code performs a "filtered read." It asks the kernel for the directory list, intercepts the result, searches for any file name matching its malicious payload (like voidlink_exec or backdoor.so), and strips those lines out.
the framework supports multiple stealth mechanisms, including Loadable Kernel Module (LKM) rootkits, LD_PRELOAD user-space persistence techniques, and eBPF-based capabilities.
they can manipulate the kernel’s internal function pointers. Specifically, they can overwrite the handler for the getdents64 syscall.
VoidLink searches for Kubernetes service account tokens, which are commonly mounted inside pods at /var/run/secrets/kubernetes.io/serviceaccount/.
VoidLink's approach uses a kernel timer that fires every five seconds and iterates over the entire process list... for_each_process(task) { if (is_debug_tool(task->comm))
Before deciding what to do, it profiles the environment it's running in. It can identify major cloud providers—including AWS, Microsoft Azure, Google Cloud Platform, Alibaba Cloud, and Tencent Cloud—as well as determine whether it's running inside Docker containers or Kubernetes workloads.
Before loading the rootkit, the script scans /proc/*/exe for any process running from a memfd file descriptor.
Check Point's analysis revealed VoidLink to be a sophisticated, modular command-and-control framework written in Zig, featuring cloud-environment detection...
In January 2026, Check Point Research (CPR) exposed VoidLink, a Linux-based malware framework featuring modular command-and-control (C2) architecture, eBPF and LKM rootkits, cloud and container enumeration, and more than 30 post-exploitation plugins.
It can identify major cloud providers—including AWS, Microsoft Azure, Google Cloud Platform, Alibaba Cloud, and Tencent Cloud
one developer used an AI environment to produce VoidLink, an 88,000-line command-and-control offensive framework, in under a week.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
77 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An 88,000-line offensive command-and-control framework reportedly produced with the help of an AI environment in under a week.
A remote-control toolkit for infected computers; described as a sophisticated platform whose development was accelerated with AI-assisted coding.
A sophisticated toolkit for remotely controlling infected computers; the report says a single developer used a commercial AI coding tool to produce about 88,000 lines of working code in under a week.
An AI-produced offensive command-and-control framework described as deployment-ready malware/tooling generated rapidly with AI assistance.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.