LinkProMalware
According to Synacktiv, LinkPro targets the GNU/Linux systems and is developed in Golang. It is named after its main module and the corresponding (private) GitHub repository. LinkPro uses eBPF technology, to activate only when receiving a "magic package", and to hide on the compromised system.From MISP Galaxy
Last reported 2 months ago, by Datadog Security Labs1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1014Rootkit
“Detection primitives for eBPF rootkits”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Detection primitives for eBPF rootkits“LinkPro, VoidLink, and the more recent Atomic Arch campaign all use these approaches.”
Thanks — we review every report.