datadog-security-labs Jul 27, 2026 · Crawled Jul 27, 2026

Detection primitives for eBPF rootkits

2 Malware

AI Summary

Recent Linux malware campaigns such as VoidLink, LinkPro, and Atomic Arch leverage eBPF rootkit techniques to evade detection by manipulating kernel-level operations. These rootkits use powerful eBPF helpers like bpf_probe_write_user, bpf_override_return, and bpf_send_signal to hide network connections, suppress enumeration of malicious eBPF programs, and terminate forensic analysis tools. The article highlights that these threats can bypass traditional security tools by tampering with system call outputs and kernel data structures, making early detection at program load time critical.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware VoidLink → Malware LinkPro →

MITRE ATT&CK TTPs 4 techniques

T1055 Process Injection · Defense Evasion T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.004 File Deletion · Defense Evasion T1610 Deploy Container · Defense Evasion