As cited
Copy frozen at (site build).
threat intel
Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework
Elastic Security Labs published technical analysis of VoidLink, a Linux malware framework that leverages Loadable Kernel Modules and eBPF (extended Berkeley Packet Filter) to establish persistence on compromised systems. The framework combines kernel-level and in-kernel virtual machine techniques to evade detection.
Why it matters: Linux infrastructure operators and threat hunters need to understand VoidLink's kernel-based evasion tactics to detect and defend against this sophisticated persistence mechanism in enterprise environments.
- Source published
- First seen by Cybersecurity Tracker