Datadog Security Labs' "Detection primitives for eBPF rootkits" (2026-07-27) synthesizes three separately disclosed Linux rootkit/malware families to argue that eBPF helper-function combinations requested at BPF_PROG_LOAD time are a durable, pre-verifier detection signal because load time is "the last moment the kernel's view of an eBPF program can be trusted."

VoidLink, documented by Check Point Research on 2026-01-13, is a modular, Zig-written cloud-native C2 framework with 37 in-memory plugins spanning reconnaissance, cloud/Kubernetes privilege escalation (docker_escape, k8s_privesc), credential harvesting (ssh_harvester, browser_stealer, passwd_dump, keyring_dump), persistence, lateral movement, and anti-forensics, plus HTTP/HTTPS, ICMP, DNS-tunneling, and partial P2P/mesh C2 channels. Its network-hiding eBPF program places a kprobe/kretprobe pair on __sys_recvmsg to intercept SOCK_DIAG_BY_FAMILY Netlink responses, then calls bpf_probe_write_user() to inflate the nlmsg_len field of the inet_diag_msg record preceding the one to hide by exactly NLMSG_ALIGN(B.nlmsg_len) — enough to make NLMSG_NEXT's traversal cursor skip the hidden record entirely while still passing NLMSG_OK bounds validation, so ss and netstat silently omit selected TCP connections. Check Point assessed the framework was built by a single, Chinese-affiliated developer using AI-assisted tooling (the TRAE IDE) in under a week, and found no evidence of real-world infections at publication — VoidLink is best treated as an advanced but not-yet-deployed capability.

LinkPro, discovered by Synacktiv's CSIRT (published 2025-10-14) during incident response on a compromised AWS environment, IS observed in a live intrusion. Initial access was an exposed Jenkins server vulnerable to CVE-2024-23897 (CVSS 9.8, CLI @-file-path expansion allowing unauthenticated arbitrary file read), which the actor used to pivot into multiple Amazon EKS clusters and deploy the malicious Docker Hub image kvlnt/vv. That image's start.sh launched a Vnt VPN client (/app/link, connecting to vnt.wherewego.top:29872) and a Rust downloader (/app/app, "vGet") that pulled a vShell 4.9.3 implant staged on S3 (https://fixupcount.s3.dualstack.ap-northeast-1.amazonaws.com/wehn/rich.png) before dropping the Golang LinkPro rootkit itself. LinkPro's Hide eBPF module places tracepoint/kretprobe hooks on getdents64 and sys_bpf: on sys_bpf it checks BPF_PROG_GET_NEXT_ID / BPF_MAP_GET_NEXT_ID / BPF_LINK_GET_NEXT_ID enumeration calls (bpf(2) commands 11, 12, 31) against an allowlist and calls bpf_override_return(ctx, -ENOENT) on a match — which has the side effect of truncating enumeration of every subsequent, non-malicious program with a higher ID as well, and requires a kernel built with CONFIG_BPF_KPROBE_OVERRIDE (present on recent Amazon Linux and Ubuntu 24.04); LinkPro falls back to an /etc/ld.so.preload shared-library hook (/etc/libld.so) when that config is absent. Its Knock module uses an XDP ingress program to watch for a "magic packet" (TCP SYN, window size 54321), records the source IP in a 1-hour-TTL map, and rewrites inbound/outbound TCP ports (via a paired TC egress program) to redirect real C2 traffic to port 2233/2333 while any port scan of the host shows nothing listening. The backdoor persists as a fake systemd unit (/etc/systemd/system/systemd-resolveld.service enabling a binary at /usr/lib/.system/.tmp~data.resolveld, masquerading as systemd-resolved and timestomped to match /etc/passwd), supports interactive shell, file management, chunked Base64 exfiltration, and SOCKS5 reverse-proxy pivoting, and was observed beaconing to 56.155.98.37 (active/forward mode, WebSocket) and 18.199.101.111. Synacktiv found no formal attribution beyond apparent financial motivation.

Atomic Arch is a supply-chain campaign, first reported by Sonatype and expanded on by Corgea and StepSecurity, that on 2026-06-11/12 adopted roughly 1,619 orphaned Arch User Repository (AUR) packages and poisoned their PKGBUILD install scripts to pull malicious npm/Bun dependencies — atomic-lockfile@1.4.2, lockfile-js@1.4.2 (Sonatype-2026-003775 / -003808), and a second-wave js-digest@4.2.2 — whose bundled Rust ELF payload (deps, sha256 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b) harvests GitHub tokens, SSH keys, HashiCorp Vault credentials, browser cookies, and chat-app (Slack/Discord/Teams/Telegram) session data, exfiltrating over HTTP POST /api/upload and controlled via POST /api/agent. When run as root the payload deploys an eBPF rootkit (referencing source scales.bpf.c) that hooks getdents64() to hide PIDs, filenames, and socket inodes from /proc via hidden_pids/hidden_names/hidden_inodes maps, interferes with NETLINK_SOCK_DIAG-based socket enumeration, and — the technique that gives the campaign its place in Datadog's article — runs an enter_ptrace program on tp/syscalls/sys_enter_ptrace that inspects every ptrace() call for PTRACE_ATTACH (0x10) or PTRACE_SEIZE (0x4206) against a hidden-PID map and calls bpf_send_signal()/bpf_send_signal_thread() to SIGKILL the calling debugger — not the target — before the kernel completes the attach, leaving no visible sign that an eBPF program caused the crash.

Datadog's proposed countermeasure instruments the BPF_PROG_LOAD syscall itself: an LSM security_bpf_prog hook records program type/attach type/name/tag/ID, a kprobe on check_helper_call extracts the raw helper IDs a program requests before the verifier can rewrite them, and the syscall-exit path stitches identity and helper metadata into one event evaluated against rules such as "BPF_PROG_LOAD && BPF_PROBE_WRITE_USER in bpf.prog.helpers", the same pattern for BPF_OVERRIDE_RETURN, and for BPF_SEND_SIGNAL / BPF_SEND_SIGNAL_THREAD — with correlation of multiple such loads from one process within an hour flagged as high-confidence rootkit installation.