Loading story…
Security research highlighted a continued shift in attacker tradecraft toward Linux cloud and container environments, with stealth-focused malware increasingly abusing modern kernel capabilities. Elastic Security Labs documented the evolution of Linux rootkits from userland hijacking and LKM implants to newer generations that leverage eBPF and io_uring for stealth and evasion, citing examples including TripleCross, Boopkit, and RingReaper. Separately, reporting on VoidLink described a cloud-native malware framework designed to operate inside Linux workloads, detect whether it is running in major cloud providers and in Docker/Kubernetes, and adapt its behavior to remain persistent while harvesting sensitive material such as cloud metadata and credentials.
Operationally, the same kernel features and observability gaps being leveraged by attackers are also driving defensive tooling improvements. Trail of Bits released mquire, an open-source Linux memory forensics tool intended to reduce dependency on external debug symbols by extracting structure and symbol information directly from memory using BPF Type Format (BTF) and Kallsyms (e.g., /proc/kallsyms-style data), then exposing findings through an interactive SQL query interface. While mquire is not tied to a single named campaign, it is directly relevant to investigating advanced Linux threats (including kernel-level implants and stealthy cloud malware) by enabling more reliable post-compromise analysis of Linux memory dumps across kernel versions.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-12, Elastic Security Labs published a technical analysis of a leaked VoidLink rootkit data dump containing source code, binaries, and deployment scripts. The report detailed a hybrid LKM-and-eBPF design, linked the framework to a Chinese-speaking threat actor, described operational artifacts suggesting real-world deployment, and released detection guidance including a YARA rule.
On March 5, 2026, Elastic Security Labs published a two-part research series describing the evolution of Linux rootkits toward stealthier eBPF- and io_uring-based techniques. The research explained how these methods can evade traditional module-based and syscall-monitoring defenses and offered detection and hardening guidance.
Cisco Talos reported observing an advanced threat actor using VoidLink in real-world campaigns, primarily targeting technology and financial organizations. According to the report, attackers gained initial access through pre-obtained credentials or exploitation of exposed enterprise services.
Trail of Bits released mquire, an open-source Linux memory forensics tool that analyzes memory dumps without external debug symbols by combining kernel-embedded BTF and Kallsyms data. The tool provides an interactive SQL-style interface for investigating processes, files, network artifacts, kernel modules, logs, and hidden-process indicators.
On 2026-01-16, Sysdig Threat Research published an analysis of the VoidLink Linux malware framework, describing a fileless Zig-based loader chain, adaptive deployment via eBPF, LKM, or hybrid rootkits, and server-side compilation of kernel-specific modules by the C2. Sysdig also documented covert control channels including HTTP, prctl-based local control, and an ICMP backdoor, and assessed the malware as likely developed by Chinese-speaking operators.
In January 2026, Check Point analysts reported that leaked VoidLink development artifacts indicated the framework was built by a single developer using ByteDance's TRAE SOLO AI development environment and a spec-driven workflow. The analysis said the operator produced a functional Linux implant by 2025-12-04, showing AI-assisted malware development had become operational rather than theoretical.
In December 2025, Check Point Research disclosed VoidLink as a cloud-native malware framework built from scratch to target Linux cloud and container workloads. The disclosure highlighted its environment-aware execution and theft of secrets such as cloud metadata, API credentials, and Git tokens.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
11 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourceelastic.co
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcewebflow.sysdig.com
Open sourceinfosec.pub
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **VoidLink**, a modular Linux malware and command-and-control framework built for stealthy, long-term access in cloud and container environments. The framework is written largely in Zig and includes custom loaders, implants, rootkits, and more than 30 plugins, with logic to detect major cloud providers as well as Kubernetes and Docker so it can adapt to the host environment. Check Point said VoidLink supports multiple C2 channels including `HTTP/HTTPS`, `DNS`, `ICMP`, `WebSocket`, and `HTTP/2`, uses anti-analysis and anti-forensic features such as runtime code encryption, integrity checks, log wiping, and self-deletion on tampering, and offers several rootkit options including `LD_PRELOAD`, `LKM`, and **eBPF** implementations. Datadog Security Labs highlighted VoidLink as an in-the-wild example of malware abusing **eBPF** to defeat host visibility, alongside LinkPro and Atomic Arch. In VoidLink’s case, the rootkit uses `bpf_probe_write_user()` to alter Netlink socket-diagnostic responses so tools such as `ss` omit selected TCP connections without breaking output parsing. Datadog said this reflects a broader shift toward eBPF-based kernel evasion that can hide activity from both user-space tools and some kernel introspection, and recommended monitoring `BPF_PROG_LOAD` events and flagging suspicious helper usage at load time as a high-confidence way to detect rootkit installation before the malicious program attaches.
Jul 27, 2026
Check Point Research reported a newly identified, highly modular Linux malware framework dubbed **VoidLink**, designed for long-term, stealthy control of Linux servers and containerized infrastructure. The framework is described as “cloud-first,” with a professional operator ecosystem that includes a web-based management dashboard and a custom plugin architecture (reported as inspired by Cobalt Strike’s BOF model) that allows capabilities to be added or removed as campaign objectives change. Reporting indicates VoidLink ships with **30+ modules/plugins** spanning reconnaissance, credential theft, privilege escalation, lateral movement, and anti-forensics (including log wiping), and it can adapt its behavior based on the environment to reduce detection risk. VoidLink is positioned as a direct threat to enterprise cloud workloads, with functionality to identify whether an infected host is running in major public cloud providers by querying instance metadata via provider APIs (including **AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud**, with indications of planned expansion to additional providers). Both accounts emphasize that the breadth and engineering quality are atypical for Linux malware and align more with “professional” threat actor tradecraft, reflecting increased attacker focus on **Linux servers, Kubernetes clusters, and Docker/containerized environments** that underpin modern enterprise deployments.
Jun 29, 2026
Researchers analyzed a leaked development archive attributed to a Chinese-speaking threat actor containing VoidLink Linux rootkit source code, binaries, deployment scripts, and version history. The framework pairs a loadable kernel module (LKM) for kernel-level hiding, ftrace hooks, and ICMP-based command-and-control with an eBPF component that alters Netlink response buffers to hide network connections from the `ss` utility. The code shows at least four generations of development, evolving from CentOS 7 syscall-table patching to Linux 5.x ftrace-based hooks. Later versions added delayed initialization, anti-debugging, protection against process termination, module-name obfuscation, and persistence mechanisms intended to conceal memfd-backed fileless implants. Deployment artifacts linked operational infrastructure to Alibaba Cloud IP addresses, while source annotations and iterative revisions supported prior assessments that its development involved human operators using AI assistance.
Sep 9, 2026