VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2 — Threadlinqs Intelligence
As of 2026-05-30, VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2 is a high-severity malware threat attributed to a China-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0284 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: China · UNKNOWN
VoidLink is a sophisticated Linux rootkit framework attributed to a Chinese-speaking threat actor that combines Loadable Kernel Modules (LKM) with eBPF programs to achieve stealth persistence,
VoidLink represents a significant advancement in Linux rootkit design, combining traditional Loadable Kernel Module (LKM) techniques with modern extended Berkeley Packet Filter (eBPF) programs to create a hybrid stealth framework that evades both legacy and contemporary detection tools.
**Architecture Overview**
The framework operates as a dual-component system. The LKM component handles core rootkit functions: process hiding via getdents64 syscall hooking through ftrace, file and module trace removal via vfs_read filtering, network connection hiding via seq_show kretprobes, signal interception for process protection, and ICMP-based command-and-control through Netfilter hooks. The eBPF component specifically targets the ss utility through a novel "swallowing" technique — hooking __sys_recvmsg at entry and return to capture userspace buffer addresses and then walk Netlink message chains, extending the previous message's nlmsg_len field to absorb hidden socket entries.
**Four Generations of Development**
Generation 1 (CentOS 7): stealth_centos7_v2.c (1,148 lines) targeting kernel 3.10, using direct syscall table modification via CR0 register manipulation with a flexible symbol finder handling GCC compiler optimization suffixes (.isra, .constprop, .part).
Generation 2 (Kernel 5.x): stealth_kernel5x.c (767 lines) replacing direct syscall hooking with the ftrace framework and employing the "kprobe trick" for symbol resolution after kallsyms_lookup_name() became unexported in kernel 5.7.
Generation 3 (Production): Located in kernel5x_new/ and lkm_5x/ directories, adding configurable module parameters (init_pids, init_ports, stealth flag) and dual Netfilter hook registration on both NF_INET_PRE_ROUTING and NF_INET_LOCAL_IN chains.
Generation 4 ("Ultimate Stealth v5"): stealth_v5.c (876 lines) implementing delayed initialization (3-second deferral via schedule_delayed_work()), anti-debugging timers firing every 5 seconds to detect forensic tools (strace, ltrace, gdb, perf, bpftool, bpftrace, systemtap, crash, kdb, trace-cmd, ftrace, sysdig, dtrace), process kill protection by hooking do_send_sig_info to discard SIGKILL/SIGTERM/SIGSTOP/SIGINT/SIGHUP/SIGQUIT for protected PIDs, and XOR-obfuscated module names at runtime.
**ICMP C2 Protocol**
The C2 channel operates over ICMP Echo Requests intercepted by Netfilter hooks. Packets matching the magic identifier 0xC0DE are silently dropped (NF_DROP) before the kernel processes them. The protocol uses a 64-byte icmp_cmd structure with a command byte, length field, and 62-byte XOR-encrypted payload (key: 0x42). Version 5 supports 10 commands including GIVE_ROOT (0x11) for privilege escalation via prepare_creds()/commit_creds(), SET_KEY (0x20) for runtime credential rotation, and commands for process hiding, port hiding, IP hiding, module discovery, and self-destruction.
**Evasion Techniques**
Delayed Initialization: mod_init() returns successfully after resolving only kallsyms_lookup_name via the kprobe trick, with actual hook installation deferred by 3 seconds via schedule_delayed_work() to evade synchronous module-load security checks. Module Masquerading: Copies legitimate AMD Memory Encryption (SME/SEV) driver metadata and description strings. Fileless Integration: load_lkm.sh scans /proc/*/exe for processes running from memfd file descriptors, auto-hiding them upon rootkit activation.
**AI-Assisted Development**
Source code contains phase-numbered refactoring annotations structured as: Phase 1 (security/logic vulnerabilities), Phase 2 (stealth enhancements), Phase 3 (compatibility), Phase 4 (stability), Phase 5 (defense mechanisms). Tutorial-style comments, chain-of-thought reasoning traces, and consistent Unicode box-drawing headers across all files indicate LLM-assisted development using the TRAE SOLO AI assistant. Check Point Research documents this as the first evidently documented case of a sophisticated malware framework authored almost entirely by AI, with development
Target sectors: government, technology, cloud-services, telecommunications, defense, critical-infrastructure
Target regions: Asia-Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1547, T1547, T1059, T1106, T1548, T1068, T1014, T1036, T1036, T1564