VoidLinkMalware
VoidLink is a cloud-native Linux malware family designed as a modular post-exploitation framework for modern cloud and containerized environments. It features a plugin-based architecture with dynamically loadable components that provide reconnaissance, credential harvesting, privilege escalation, lateral movement, persistence, and anti-forensic capabilities.From MISP Galaxy
Last reported 1 month ago, by Elastic Security Labs3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1014Rootkit
“Detection primitives for eBPF rootkits”
- T1003.007Proc Filesystem
“Linux exposes process information through the proc filesystem.”
- T1036Masquerading
“Module masquerading”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Linux Detection Engineering - Fileless Execution“In our own analysis of VoidLink, we observed how fileless execution can be paired with a rootkit.”
-
Detection primitives for eBPF rootkits“LinkPro, VoidLink, and the more recent Atomic Arch campaign all use these approaches.”
-
Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework“Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework”
Indicators in its reports
named in the reports above- 8.149.128[.]10in 1 report
- 116.62.172[.]147in 1 report
- echo[.]idin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.