LinkPro rootkit eBPF concealment and magic-packet activation analysis
Technical Analysis
Summary
Hide ▲
Show ▼
Synacktiv disclosed LinkPro, a new GNU/Linux rootkit that uses eBPF concealment and magic-packet activation, raising stealth and detection risk in compromised AWS-hosted environments. The malware can hide kernel- and user-space traces while waiting for an operator-defined trigger before accepting commands. Its design shows how post-exploitation tooling can maintain persistence and covert access across Kubernetes-backed infrastructure.
Related Happenings
Quasar Linux (QLNX) Linux RAT targeting developer credentials
Malware Activity
First: 06.05.2026 12:48
Last: 06.05.2026 12:48
Sources 1
About this happening:
The **Quasar Linux (QLNX)** RAT has been identified as a **Linux backdoor** that can steal **developer credentials** and compromise software-supply-chain publishing pipelines. It...
Quasar Linux (QLNX) Linux RAT targeting developer credentials
Malware ActivityAbout this happening: The **Quasar Linux (QLNX)** RAT has been identified as a **Linux backdoor** that can steal **developer credentials** and compromise software-supply-chain publishing pipelines. It...
VoidLink Linux C2 malware activity
Malware Activity
First: 09.02.2026 17:25
Last: 09.02.2026 17:25
Sources 1
About this happening:
**VoidLink** is an operational **Linux C2 framework** used by **UAT-9921** as a **post-compromise tool** against **technology and financial services** targets. Cisco Talos says th...
VoidLink Linux C2 malware activity
Malware ActivityAbout this happening: **VoidLink** is an operational **Linux C2 framework** used by **UAT-9921** as a **post-compromise tool** against **technology and financial services** targets. Cisco Talos says th...
VoidLink AI-generated malware development analysis
Technical Analysis
First: 21.01.2026 14:51
Last: 21.01.2026 14:51
Sources 1
About this happening:
**VoidLink** is a **Linux-based C2 framework** with **multi-cloud targeting** and **modular implants** built for **credential theft**, **data exfiltration** and **stealthy persist...
VoidLink AI-generated malware development analysis
Technical AnalysisAbout this happening: **VoidLink** is a **Linux-based C2 framework** with **multi-cloud targeting** and **modular implants** built for **credential theft**, **data exfiltration** and **stealthy persist...
VoidLink analysis reveals Kubernetes/Docker checks and modular anti-analysis behavior
Technical Analysis
First: 14.01.2026 00:12
Last: 14.01.2026 00:12
Sources 1
About this happening:
**VoidLink** is a **Linux C2 framework** built for **cloud and container environments**, with **multi-cloud targeting** across **AWS, Google Cloud Platform, Microsoft Azure, Aliba...
VoidLink analysis reveals Kubernetes/Docker checks and modular anti-analysis behavior
Technical AnalysisAbout this happening: **VoidLink** is a **Linux C2 framework** built for **cloud and container environments**, with **multi-cloud targeting** across **AWS, Google Cloud Platform, Microsoft Azure, Aliba...
EtherRAT remote access trojan with blockchain-based C2
Malware Activity
First: 09.12.2025 19:15
Last: 09.12.2025 19:15
Sources 1
About this happening:
**EtherRAT** is now a live **Linux RAT** threat because it combines **Ethereum smart contracts** for C2 with multiple persistence layers, making blocked infrastructure less effect...
EtherRAT remote access trojan with blockchain-based C2
Malware ActivityAbout this happening: **EtherRAT** is now a live **Linux RAT** threat because it combines **Ethereum smart contracts** for C2 with multiple persistence layers, making blocked infrastructure less effect...
Timeline
-
16.10.2025 17:28 2 articles · 7mo ago
Synacktiv discloses LinkPro Linux rootkit with eBPF concealment
Technical Analysis UpdateSynacktiv disclosed LinkPro, a new GNU/Linux rootkit found in an AWS-hosted infrastructure compromise that began with an exposed Jenkins server vulnerable to CVE-2024–23897 and a malicious Docker Hub image deployed to Kubernetes clusters. The analysis describes kernel-level concealment through two eBPF modules, a magic TCP packet trigger with window size 54321, a one-hour command window after activation, and a /etc/ld.so.preload fallback that loads libld.so to hide user-space artifacts.
Show sources
- LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets — thehackernews.com — 16.10.2025 17:28
- LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets — thehackernews.com — 16.10.2025 17:28