# VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2

> VoidLink is a sophisticated Linux rootkit framework attributed to a Chinese-speaking threat actor that combines Loadable Kernel Modules (LKM) with eBPF programs to achieve stealth persistence, process/network hiding, and covert ICMP-based command-and-control. Four generations of the framework target CentOS 7, Linux kernel 5.x, and Ubuntu 22.04, with C2 infrastructure hosted on Alibaba Cloud. Evidence strongly suggests AI-assisted development using the TRAE IDE, producing 88,000+ lines of code in approximately one week.

- **Published:** 2026-03-25T12:00:00Z
- **Last reviewed:** 2026-03-25T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0284
- **ID:** TL-2026-0284
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

VoidLink represents a significant advancement in Linux rootkit design, combining traditional Loadable Kernel Module (LKM) techniques with modern extended Berkeley Packet Filter (eBPF) programs to create a hybrid stealth framework that evades both legacy and contemporary detection tools.

**Architecture Overview**

The framework operates as a dual-component system. The LKM component handles core rootkit functions: process hiding via getdents64 syscall hooking through ftrace, file and module trace removal via vfs_read filtering, network connection hiding via seq_show kretprobes, signal interception for process protection, and ICMP-based command-and-control through Netfilter hooks. The eBPF component specifically targets the ss utility through a novel "swallowing" technique — hooking __sys_recvmsg at entry and return to capture userspace buffer addresses and then walk Netlink message chains, extending the previous message's nlmsg_len field to absorb hidden socket entries.

**Four Generations of Development**

Generation 1 (CentOS 7): stealth_centos7_v2.c (1,148 lines) targeting kernel 3.10, using direct syscall table modification via CR0 register manipulation with a flexible symbol finder handling GCC compiler optimization suffixes (.isra, .constprop, .part).

Generation 2 (Kernel 5.x): stealth_kernel5x.c (767 lines) replacing direct syscall hooking with the ftrace framework and employing the "kprobe trick" for symbol resolution after kallsyms_lookup_name() became unexported in kernel 5.7.

Generation 3 (Production): Located in kernel5x_new/ and lkm_5x/ directories, adding configurable module parameters (init_pids, init_ports, stealth flag) and dual Netfilter hook registration on both NF_INET_PRE_ROUTING and NF_INET_LOCAL_IN chains.

Generation 4 ("Ultimate Stealth v5"): stealth_v5.c (876 lines) implementing delayed initialization (3-second deferral via schedule_delayed_work()), anti-debugging timers firing every 5 seconds to detect forensic tools (strace, ltrace, gdb, perf, bpftool, bpftrace, systemtap, crash, kdb, trace-cmd, ftrace, sysdig, dtrace), process kill protection by hooking do_send_sig_info to discard SIGKILL/SIGTERM/SIGSTOP/SIGINT/SIGHUP/SIGQUIT for protected PIDs, and XOR-obfuscated module names at runtime.

**ICMP C2 Protocol**

The C2 channel operates over ICMP Echo Requests intercepted by Netfilter hooks. Packets matching the magic identifier 0xC0DE are silently dropped (NF_DROP) before the kernel processes them. The protocol uses a 64-byte icmp_cmd structure with a command byte, length field, and 62-byte XOR-encrypted payload (key: 0x42). Version 5 supports 10 commands including GIVE_ROOT (0x11) for privilege escalation via prepare_creds()/commit_creds(), SET_KEY (0x20) for runtime credential rotation, and commands for process hiding, port hiding, IP hiding, module discovery, and self-destruction.

**Evasion Techniques**

Delayed Initialization: mod_init() returns successfully after resolving only kallsyms_lookup_name via the kprobe trick, with actual hook installation deferred by 3 seconds via schedule_delayed_work() to evade synchronous module-load security checks. Module Masquerading: Copies legitimate AMD Memory Encryption (SME/SEV) driver metadata and description strings. Fileless Integration: load_lkm.sh scans /proc/*/exe for processes running from memfd file descriptors, auto-hiding them upon rootkit activation.

**AI-Assisted Development**

Source code contains phase-numbered refactoring annotations structured as: Phase 1 (security/logic vulnerabilities), Phase 2 (stealth enhancements), Phase 3 (compatibility), Phase 4 (stability), Phase 5 (defense mechanisms). Tutorial-style comments, chain-of-thought reasoning traces, and consistent Unicode box-drawing headers across all files indicate LLM-assisted development using the TRAE SOLO AI assistant. Check Point Research documents this as the first evidently documented case of a sophisticated malware framework authored almost entirely by AI, with development starting late November 2025 and producing a first functional implant by December 4, 2025 — approximately one week to reach 88,000+ lines of code.

**Attribution**

Attributed to a Chinese-speaking threat actor based on Simplified Chinese source code comments, Chinese-language instruction documents and sprint plans, and Alibaba Cloud infrastructure. OPSEC failures exposed development timelines, technical specifications, and design documentation. The actor employed Spec Driven Development (SDD) methodology with AI-generated 20-week development plans across three internal teams.

## MITRE ATT&CK

- T1547 Boot or Logon Autostart Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1548 Abuse Elevation Control Mechanism
- T1068 Exploitation for Privilege Escalation
- T1014 Rootkit
- T1036 Masquerading
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1082 System Information Discovery
- T1095 Non-Application Layer Protocol
- T1205 Traffic Signaling
- T1573 Encrypted Channel
- T1001 Data Obfuscation
- T1005 Data from Local System
- T1489 Service Stop

## Sources

- [Elastic Security Labs — Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework](https://www.elastic.co/security-labs/illuminating-voidlink)
- [Check Point Research — VoidLink: First documented AI-authored malware framework](https://research.checkpoint.com/2026/voidlink)
- [MITRE ATT&CK — Rootkit (T1014)](https://attack.mitre.org/techniques/T1014/)
- [MITRE ATT&CK — Kernel Modules and Extensions (T1547.006)](https://attack.mitre.org/techniques/T1547/006/)
- [MITRE ATT&CK — Non-Application Layer Protocol (T1095)](https://attack.mitre.org/techniques/T1095/)
- [Linux Kernel eBPF Documentation](https://docs.kernel.org/bpf/)
- [TRAE IDE — AI-Assisted Development Tool by ByteDance](https://www.trae.ai/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0284