Loading story…
A sophisticated cyberattack targeted AWS-hosted infrastructure, specifically exploiting a vulnerable Jenkins server to gain initial access. The attackers leveraged CVE-2024-238976 to move laterally into AWS Elastic Kubernetes Service (EKS) clusters, where they deployed a malicious Docker image named kvlnt/vv. This image contained a Rust-based downloader, vGet, which was used to retrieve an encrypted vShell backdoor payload from an Amazon S3 bucket. The threat actors achieved persistence and escalated privileges by exploiting container escape vulnerabilities, particularly through host filesystem mounts. Once inside the environment, the attackers installed the LinkPro rootkit, a Golang-based malware designed for GNU/Linux systems. LinkPro embeds four ELF binaries, including two eBPF modules called 'Hide' and 'Knock', a shared library (libld.so), and an unused kernel module (arp_diag.ko). The Hide module uses tracepoint and kretprobe hooks on getdents and sys_bpf to conceal files, processes, and its own BPF maps, effectively evading detection by tools such as bpftool. The Knock module listens for specially crafted TCP 'magic packets' (SYN packets with a window size of 54321) to activate its command and control (C2) listener, redirecting traffic to a hidden port (2233) and bypassing firewalls and log monitoring. If eBPF is unavailable due to kernel restrictions, LinkPro falls back to using the LD_PRELOAD technique, installing a malicious shared library to hook libc functions and hide its presence in user space. Persistence is further maintained by masquerading as systemd-resolved, creating deceptive files and unit configurations to blend in with legitimate system processes. Once operational, LinkPro provides attackers with full remote shell access, file manipulation capabilities, SOCKS5 proxy tunneling, and DNS/HTTP-based C2 communications. The infection chain demonstrates advanced techniques for both initial compromise and stealthy long-term access, including the use of encrypted payloads, container escape, and kernel-level rootkit functionality. The campaign highlights the growing abuse of eBPF technology by threat actors to evade traditional security controls and maintain covert access to cloud and Linux environments. Indicators of compromise and YARA rules have been published to aid in detection and response. The incident underscores the importance of securing CI/CD pipelines, monitoring for unusual container activity, and hardening Linux kernel configurations against eBPF abuse. No definitive attribution has been made regarding the threat actors behind this campaign. The attack serves as a warning for organizations leveraging cloud-native technologies and underscores the need for robust monitoring and incident response capabilities.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
On October 14, 2025, Synacktiv published its investigation detailing the AWS compromise, the malware chain, and the LinkPro eBPF rootkit's concealment and activation mechanisms. Wiz also published a related incident entry the same day covering the eBPF rootkit targeting AWS and Linux environments.
The final payload identified was LinkPro, a Golang backdoor/rootkit for GNU/Linux that used eBPF for stealth and conditional activation via a magic packet. It supported reverse and forward connectivity, interactive shell access, file operations, and SOCKS5 pivoting while persisting as a fake systemd-resolved-like service.
Weeks after the initial compromise, investigators observed a new stage of malware activity, including a vShell dropper that used DNS tunneling. This marked an escalation beyond the earlier container-based access and payload delivery.
The malicious container executed a Rust downloader called vGet, which retrieved an encrypted vShell 4.9.3 payload from an S3 bucket for in-memory execution. Synacktiv observed vShell command-and-control traffic over WebSocket to 56.155.98.37.
After initial access, the threat actor deployed a malicious Docker image, kvlnt/vv, into multiple Amazon EKS clusters. The image enabled host access through a bind mount of the root filesystem and was used to establish persistence, proxying, and staging for follow-on payloads.
Synacktiv assessed that the compromise began when attackers exploited an internet-exposed Jenkins server vulnerable to CVE-2024-23897, gaining initial access to the AWS-hosted environment. This was the first identified entry point in the intrusion chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **VoidLink**, a modular Linux malware and command-and-control framework built for stealthy, long-term access in cloud and container environments. The framework is written largely in Zig and includes custom loaders, implants, rootkits, and more than 30 plugins, with logic to detect major cloud providers as well as Kubernetes and Docker so it can adapt to the host environment. Check Point said VoidLink supports multiple C2 channels including `HTTP/HTTPS`, `DNS`, `ICMP`, `WebSocket`, and `HTTP/2`, uses anti-analysis and anti-forensic features such as runtime code encryption, integrity checks, log wiping, and self-deletion on tampering, and offers several rootkit options including `LD_PRELOAD`, `LKM`, and **eBPF** implementations. Datadog Security Labs highlighted VoidLink as an in-the-wild example of malware abusing **eBPF** to defeat host visibility, alongside LinkPro and Atomic Arch. In VoidLink’s case, the rootkit uses `bpf_probe_write_user()` to alter Netlink socket-diagnostic responses so tools such as `ss` omit selected TCP connections without breaking output parsing. Datadog said this reflects a broader shift toward eBPF-based kernel evasion that can hide activity from both user-space tools and some kernel introspection, and recommended monitoring `BPF_PROG_LOAD` events and flagging suspicious helper usage at load time as a high-confidence way to detect rootkit installation before the malicious program attaches.
Jul 27, 2026
Researchers analyzed a leaked development archive attributed to a Chinese-speaking threat actor containing VoidLink Linux rootkit source code, binaries, deployment scripts, and version history. The framework pairs a loadable kernel module (LKM) for kernel-level hiding, ftrace hooks, and ICMP-based command-and-control with an eBPF component that alters Netlink response buffers to hide network connections from the `ss` utility. The code shows at least four generations of development, evolving from CentOS 7 syscall-table patching to Linux 5.x ftrace-based hooks. Later versions added delayed initialization, anti-debugging, protection against process termination, module-name obfuscation, and persistence mechanisms intended to conceal memfd-backed fileless implants. Deployment artifacts linked operational infrastructure to Alibaba Cloud IP addresses, while source annotations and iterative revisions supported prior assessments that its development involved human operators using AI assistance.
Sep 9, 2026
Security research highlighted a continued shift in attacker tradecraft toward **Linux cloud and container environments**, with stealth-focused malware increasingly abusing modern kernel capabilities. Elastic Security Labs documented the evolution of Linux rootkits from userland hijacking and LKM implants to newer generations that leverage **eBPF** and **io_uring** for stealth and evasion, citing examples including **TripleCross**, **Boopkit**, and **RingReaper**. Separately, reporting on **VoidLink** described a cloud-native malware framework designed to operate inside Linux workloads, detect whether it is running in major cloud providers and in **Docker/Kubernetes**, and adapt its behavior to remain persistent while harvesting sensitive material such as cloud metadata and credentials. Operationally, the same kernel features and observability gaps being leveraged by attackers are also driving defensive tooling improvements. Trail of Bits released *mquire*, an open-source Linux memory forensics tool intended to reduce dependency on external debug symbols by extracting structure and symbol information directly from memory using **BPF Type Format (BTF)** and **Kallsyms** (e.g., `/proc/kallsyms`-style data), then exposing findings through an interactive **SQL** query interface. While *mquire* is not tied to a single named campaign, it is directly relevant to investigating advanced Linux threats (including kernel-level implants and stealthy cloud malware) by enabling more reliable post-compromise analysis of Linux memory dumps across kernel versions.
Jul 12, 2026