# eBPF Rootkit Detection: VoidLink, LinkPro, and Atomic Arch Evade Kernel-Level Monitoring

> Datadog Security Labs documents three distinct in-the-wild eBPF rootkit techniques — VoidLink's Netlink message-length tampering via bpf_probe_write_user(), LinkPro's bpf_override_return() enumeration spoofing, and Atomic Arch's bpf_send_signal() debugger-killing — and proposes load-time BPF_PROG_LOAD helper-fingerprinting as a defense that runs before any of the three can corrupt the kernel's introspection surface.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2624
- **ID:** TL-2026-2624
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-23897

## Description

Datadog Security Labs' "Detection primitives for eBPF rootkits" (2026-07-27) synthesizes three separately disclosed Linux rootkit/malware families to argue that eBPF helper-function combinations requested at BPF_PROG_LOAD time are a durable, pre-verifier detection signal because load time is "the last moment the kernel's view of an eBPF program can be trusted."

VoidLink, documented by Check Point Research on 2026-01-13, is a modular, Zig-written cloud-native C2 framework with 37 in-memory plugins spanning reconnaissance, cloud/Kubernetes privilege escalation (docker_escape, k8s_privesc), credential harvesting (ssh_harvester, browser_stealer, passwd_dump, keyring_dump), persistence, lateral movement, and anti-forensics, plus HTTP/HTTPS, ICMP, DNS-tunneling, and partial P2P/mesh C2 channels. Its network-hiding eBPF program places a kprobe/kretprobe pair on __sys_recvmsg to intercept SOCK_DIAG_BY_FAMILY Netlink responses, then calls bpf_probe_write_user() to inflate the nlmsg_len field of the inet_diag_msg record preceding the one to hide by exactly NLMSG_ALIGN(B.nlmsg_len) — enough to make NLMSG_NEXT's traversal cursor skip the hidden record entirely while still passing NLMSG_OK bounds validation, so ss and netstat silently omit selected TCP connections. Check Point assessed the framework was built by a single, Chinese-affiliated developer using AI-assisted tooling (the TRAE IDE) in under a week, and found no evidence of real-world infections at publication — VoidLink is best treated as an advanced but not-yet-deployed capability.

LinkPro, discovered by Synacktiv's CSIRT (published 2025-10-14) during incident response on a compromised AWS environment, IS observed in a live intrusion. Initial access was an exposed Jenkins server vulnerable to CVE-2024-23897 (CVSS 9.8, CLI @-file-path expansion allowing unauthenticated arbitrary file read), which the actor used to pivot into multiple Amazon EKS clusters and deploy the malicious Docker Hub image kvlnt/vv. That image's start.sh launched a Vnt VPN client (/app/link, connecting to vnt.wherewego.top:29872) and a Rust downloader (/app/app, "vGet") that pulled a vShell 4.9.3 implant staged on S3 (https://fixupcount.s3.dualstack.ap-northeast-1.amazonaws.com/wehn/rich.png) before dropping the Golang LinkPro rootkit itself. LinkPro's Hide eBPF module places tracepoint/kretprobe hooks on getdents64 and sys_bpf: on sys_bpf it checks BPF_PROG_GET_NEXT_ID / BPF_MAP_GET_NEXT_ID / BPF_LINK_GET_NEXT_ID enumeration calls (bpf(2) commands 11, 12, 31) against an allowlist and calls bpf_override_return(ctx, -ENOENT) on a match — which has the side effect of truncating enumeration of every subsequent, non-malicious program with a higher ID as well, and requires a kernel built with CONFIG_BPF_KPROBE_OVERRIDE (present on recent Amazon Linux and Ubuntu 24.04); LinkPro falls back to an /etc/ld.so.preload shared-library hook (/etc/libld.so) when that config is absent. Its Knock module uses an XDP ingress program to watch for a "magic packet" (TCP SYN, window size 54321), records the source IP in a 1-hour-TTL map, and rewrites inbound/outbound TCP ports (via a paired TC egress program) to redirect real C2 traffic to port 2233/2333 while any port scan of the host shows nothing listening. The backdoor persists as a fake systemd unit (/etc/systemd/system/systemd-resolveld.service enabling a binary at /usr/lib/.system/.tmp~data.resolveld, masquerading as systemd-resolved and timestomped to match /etc/passwd), supports interactive shell, file management, chunked Base64 exfiltration, and SOCKS5 reverse-proxy pivoting, and was observed beaconing to 56.155.98.37 (active/forward mode, WebSocket) and 18.199.101.111. Synacktiv found no formal attribution beyond apparent financial motivation.

Atomic Arch is a supply-chain campaign, first reported by Sonatype and expanded on by Corgea and StepSecurity, that on 2026-06-11/12 adopted roughly 1,619 orphaned Arch User Repository (AUR) packages and poisoned their PKGBUILD install scripts to pull malicious npm/Bun dependencies — atomic-lockfile@1.4.2, lockfile-js@1.4.2 (Sonatype-2026-003775 / -003808), and a second-wave js-digest@4.2.2 — whose bundled Rust ELF payload (deps, sha256 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b) harvests GitHub tokens, SSH keys, HashiCorp Vault credentials, browser cookies, and chat-app (Slack/Discord/Teams/Telegram) session data, exfiltrating over HTTP POST /api/upload and controlled via POST /api/agent. When run as root the payload deploys an eBPF rootkit (referencing source scales.bpf.c) that hooks getdents64() to hide PIDs, filenames, and socket inodes from /proc via hidden_pids/hidden_names/hidden_inodes maps, interferes with NETLINK_SOCK_DIAG-based socket enumeration, and — the technique that gives the campaign its place in Datadog's article — runs an enter_ptrace program on tp/syscalls/sys_enter_ptrace that inspects every ptrace() call for PTRACE_ATTACH (0x10) or PTRACE_SEIZE (0x4206) against a hidden-PID map and calls bpf_send_signal()/bpf_send_signal_thread() to SIGKILL the calling debugger — not the target — before the kernel completes the attach, leaving no visible sign that an eBPF program caused the crash.

Datadog's proposed countermeasure instruments the BPF_PROG_LOAD syscall itself: an LSM security_bpf_prog hook records program type/attach type/name/tag/ID, a kprobe on check_helper_call extracts the raw helper IDs a program requests before the verifier can rewrite them, and the syscall-exit path stitches identity and helper metadata into one event evaluated against rules such as "BPF_PROG_LOAD && BPF_PROBE_WRITE_USER in bpf.prog.helpers", the same pattern for BPF_OVERRIDE_RETURN, and for BPF_SEND_SIGNAL / BPF_SEND_SIGNAL_THREAD — with correlation of multiple such loads from one process within an hour flagged as high-confidence rootkit installation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1543.002 Create or Modify System Process: Systemd Service
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1611 Escape to Host
- T1014 Rootkit
- T1622 Debugger Evasion
- T1205.002 Socket Filters
- T1036.005 Match Legitimate Resource Name or Location
- T1070.006 Indicator Removal: Timestomp
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1552.001 Unsecured Credentials: Credentials In Files
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1090.002 Proxy: External Proxy

## Sources

- [Detection primitives for eBPF rootkits](https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/)
- [LinkPro: eBPF rootkit analysis](https://www.synacktiv.com/en/publications/linkpro-ebpf-rootkit-analysis)
- [LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets](https://thehackernews.com/2025/10/linkpro-linux-rootkit-uses-ebpf-to-hide.html)
- [VoidLink: The Cloud-Native Malware Framework](https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/)
- [Atomic Arch npm Campaign Adds Malicious Dependency](https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency)
- [Atomic Arch turned orphaned AUR packages into npm and Bun malware launchers](https://corgea.com/research/atomic-arch-aur-atomic-lockfile-js-digest-ebpf-rootkit)
- [400+ AUR Packages Hijacked: What the "Atomic Arch" Campaign Means for Supply-Chain Security](https://www.stepsecurity.io/blog/400-aur-packages-hijacked-atomic-arch-campaign)
- [CVE-2024-23897 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-23897)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2624