VoidLink eBPF Rootkit Breakdown

mttaggart · March 25, 2026, 8:57pm

You know I’m a sucker for an eBPF breakdown.

BadSamurai · March 25, 2026, 9:05pm

Additional IOCs provided by Unit42 Timely Threat Intel

github.com/PaloAltoNetworks/Unit42-timely-threat-intel

2026-03-10-IOCs-for-VoidLink-activity.txt

main

2026-03-10 (TUESDAY): VOIDLINK MALWARE ACTIVITY

AUTHORS:

- Joseph Ganter, David Lord

REFERENCES:

- https://www.linkedin.com/posts/unit42_voidlink-activity-7437210786231431168-KFkY/
- https://x.com/Unit42_Intel/status/2031445130364780771

ORIGINAL REFERENCE:

- https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/

NOTES:

- We recently investigated an open web directory on a C2 server for VoidLink malware.
- This activity has possible overlaps with an activity cluster we track as CL-STA-1015. 
- Previous versions of VoidLink malware have been seen in the wild as early as 2025-12-02.

This file has been truncated. show original

mttaggart · March 27, 2026, 1:48pm

This thing is really slick. In addition to the LKM/eBPF components, the C2 is over ICMP, but they were careful to lock it to a 64-byte packet, so you need to be paying really close attention to distinguish this C2 traffic from noise.

The amount of endpoint visibility on Linux systems necessary to catch this exceeds most orgs’ capabilities.