Loading malware…
VoidLink is a sophisticated Linux malware framework designed for long-term, stealthy access in cloud-native environments. It targets Linux servers, containers, and Kubernetes deployments, and is characterized by a modular command-and-control architecture, extensive plugin support, and multiple rootkit implementations. Public reporting describes more than 30 post-exploitation modules and environment-aware behavior tailored to modern cloud infrastructure.
VoidLink is written primarily in Zig and has been associated with AI-assisted development workflows that significantly accelerated its creation. Analysts initially assessed it as the product of a larger engineering effort, but later reporting indicated that a single developer used an AI-enabled development environment to produce a large, operational codebase in a very short period. This has made VoidLink a notable example of operationally viable AI-assisted malware engineering.
A defining feature of VoidLink is its layered stealth model. It supports userland stealth through LD_PRELOAD techniques, kernel-mode stealth through Loadable Kernel Modules, and eBPF-based rootkit functionality. Reported capabilities include hiding processes, files, modules, and network connections; manipulating kernel and user-space visibility; filtering system information exposed through common Linux interfaces; and concealing active TCP connections from administrative tools by tampering with Netlink-derived socket information. Some analyses also describe hybrid LKM-plus-eBPF deployments, delayed hook installation, anti-debugging logic, process protection, self-deletion, and covert control via ICMP in addition to conventional network-based command-and-control.
VoidLink is also notable for cloud and container awareness. It can detect whether it is running in containers or Kubernetes, identify major cloud providers, enumerate the surrounding environment, and load plugins suited to the victim context. Reported post-exploitation functionality includes searching for Kubernetes service account tokens, probing for container escape opportunities, and identifying Kubernetes privilege-escalation paths. These behaviors make it particularly relevant to attacks against cloud-hosted workloads and orchestration platforms.
Delivery and execution tradecraft described for VoidLink includes fileless and memory-resident techniques. Reported variants use staged loaders, in-memory execution, and plugin loading directly from raw ELF objects in RAM to reduce disk artifacts and complicate forensic recovery. Some analyses also describe adaptive behavior based on the presence of security tooling and kernel-version-aware rootkit deployment, including selection among eBPF, LKM, or hybrid approaches.
VoidLink has been described as Chinese-developed or linked to a Chinese-speaking threat actor based on language artifacts and operational details, although broader attribution remains limited in public reporting. Its combination of cloud-native targeting, kernel-level stealth, modular post-exploitation, and AI-accelerated development makes it a significant example of advanced Linux malware aimed at modern enterprise and cloud infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos recently discovered a new threat actor, UAT-9221, leveraging VoidLink in campaigns.
A newly tracked intrusion framework called VoidLink is drawing attention for its modular design and focus on Linux systems. It behaves like an implant management framework, letting operators deploy a core implant and add capabilities as needed...
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Appendix B: Cortex Detections ... T1059.004 - Command and Scripting Interpreter: Unix Shell Run downloaded script using pipe in a Kubernetes pod
The operator interacts with the rootkit through a Python script, icmp_ctl.py, which constructs and sends the ICMP packets using raw sockets.
Finally, load_lkm.sh provided boot-time persistence with a particularly interesting feature: It scanned /proc/*/exe for processes running from memfd file descriptors, a telltale sign of fileless implants.
The rootkit combines a traditional LKM with eBPF programs in a hybrid design... load_lkm.sh provided boot-time persistence... The load_lkm.sh boot script hard-codes a path to /root/kernel5x_new/vl_stealth.ko
The GIVE_ROOT command (0x11) is noteworthy: It takes a target PID as an argument and uses prepare_creds()/commit_creds() to set all UID and GID fields to zero for that process, effectively granting it root privileges without any authentication mechanism.
Over the past couple of years, Linux malware authors have started using eBPF rootkits to hide from both traditional and modern defenses.
The data field is XOR-encrypted with a single-byte key, 0x42 by default... The v5 variant takes this further by XOR-encrypting the module name string and decoding it at runtime.
Every VoidLink variant disguises its kernel module metadata to impersonate a legitimate AMD driver: MODULE_LICENSE("GPL"); MODULE_AUTHOR("Advanced Micro Devices, Inc."); MODULE_DESCRIPTION("AMD Memory Encryption Support").
One notable detail: The variant suppresses all kernel log output by redefining pr_info, pr_err, and pr_warn as no-ops, a simple but effective anti-forensics measure.
Researchers also documented operational security (OPSEC) features intended to make analysis more difficult, including runtime code encryption, adaptive behavior based on the execution environment, and self-deletion capabilities that can remove components when necessary.
The entire malicious logic exists as transient, encrypted blobs in memory, re-decrypted only when it needs to "beacon" back to the C2 server.
Check Point's analysis revealed VoidLink to be a sophisticated, modular command-and-control framework written in Zig, featuring cloud-environment detection...
VoidLink needs to hide connections on a specific port, a standard rootkit feature.
VoidLink's authors used it to bypass ss ... bpf_probe_write_user tampers with the buffer in place: It inflates the length field of the message before the one to hide, so the inflated length swallows the hidden message entirely and the parser's cursor jumps straight over it.
the framework supports multiple stealth mechanisms, including Loadable Kernel Module (LKM) rootkits, LD_PRELOAD user-space persistence techniques, and eBPF-based capabilities.
they can manipulate the kernel’s internal function pointers. Specifically, they can overwrite the handler for the getdents64 syscall.
VoidLink searches for Kubernetes service account tokens, which are commonly mounted inside pods at /var/run/secrets/kubernetes.io/serviceaccount/.
VoidLink's approach uses a kernel timer that fires every five seconds and iterates over the entire process list... for_each_process(task) { if (is_debug_tool(task->comm))
Before deciding what to do, it profiles the environment it's running in. It can identify major cloud providers—including AWS, Microsoft Azure, Google Cloud Platform, Alibaba Cloud, and Tencent Cloud—as well as determine whether it's running inside Docker containers or Kubernetes workloads.
Before loading the rootkit, the script scans /proc/*/exe for any process running from a memfd file descriptor.
Check Point's analysis revealed VoidLink to be a sophisticated, modular command-and-control framework written in Zig, featuring cloud-environment detection...
In January 2026, Check Point Research (CPR) exposed VoidLink, a Linux-based malware framework featuring modular command-and-control (C2) architecture, eBPF and LKM rootkits, cloud and container enumeration, and more than 30 post-exploitation plugins.
It can identify major cloud providers—including AWS, Microsoft Azure, Google Cloud Platform, Alibaba Cloud, and Tencent Cloud
one developer used an AI environment to produce VoidLink, an 88,000-line command-and-control offensive framework, in under a week.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
79 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux eBPF rootkit that hides active TCP connections from ss by using bpf_probe_write_user() to tamper with Netlink response buffers in user space, causing parsers to skip socket records for hidden ports.
An 88,000-line offensive command-and-control framework reportedly produced with the help of an AI environment in under a week.
A remote-control toolkit for infected computers; described as a sophisticated platform whose development was accelerated with AI-assisted coding.
A sophisticated toolkit for remotely controlling infected computers; the report says a single developer used a commercial AI coding tool to produce about 88,000 lines of working code in under a week.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.