Elastic Analyzes VoidLink’s Hybrid Linux Rootkit and Evasion Techniques
Summary
Elastic researchers analyzed leaked VoidLink source and describe a four-generation Linux rootkit combining LKM and eBPF stealth, ICMP command-and-control, and evasion features. They detail detection methods and evidence they say suggests AI-assisted development.
Key points
- Elastic researchers analyzed a dump containing VoidLink rootkit source code, compiled binaries and deployment scripts.
- The rootkit combines an LKM for kernel manipulation and ICMP command-and-control with eBPF that hides connections from ss by altering userspace Netlink buffers using bpf_probe_write_user.
- The analysis traces at least four generations, from CentOS 7 syscall-table patching to ftrace hooks, module parameters and an eBPF companion for newer kernels.
- The latest variant includes delayed hook installation, anti-debugging checks, process kill protection and module masquerading.
- The ICMP command channel uses XOR-obfuscated payloads and supports runtime rotation of its identifier and key.
- The authors infer human-in-the-loop, AI-assisted development from source annotations and iterative versions, alongside compiled modules and testing artifacts.
- Suggested defenses include auditing kernel module loads, inspecting unexpected ftrace hooks and eBPF programs, cross-checking system views, enforcing Secure Boot and module signing, and restricting eBPF.
Article Details
- Attack Vectors
- VoidLink combines a Linux kernel module with eBPF programs to conceal processes, files, modules and network connections.
- An operator sends commands in XOR-obfuscated ICMP Echo Requests; the rootkit intercepts and drops matching packets before normal ICMP processing.
- A boot loader loads the rootkit and passes it PIDs of processes running from memfd file descriptors for immediate concealment.
- Defensive Notes
- Inspect module lists, ftrace hooks and eBPF programs from a trusted environment because the rootkit can filter system views.
- Monitor module-loading syscalls and unexpected use of bpf_probe_write_user; investigate kprobe and kretprobe programs attached to __sys_recvmsg.
- Cross-reference process and network views, including ps, /proc, netstat and ss, for discrepancies.
- Enforce Secure Boot and kernel module signing, and restrict eBPF access using appropriate system policies.
- Correlate ICMP Echo Requests with replies to identify suspicious unanswered requests.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 116[.]62[.]172[.]147 | Reported operator infrastructure referenced in VoidLink's ICMP control script examples. |
| IPV4 | 8[.]149[.]128[.]10 | Reported operator infrastructure referenced in VoidLink's ICMP control script examples. |
MITRE ATT&CK
T1014 · RootkitVoidLink hooks kernel functions and manipulates Netlink responses to conceal its module, processes and network connections.T1027 · Obfuscated Files or InformationThe v5 variant XOR-obfuscates its module name in the compiled binary and decodes it at runtime.T1036.005 · Match Legitimate Resource Name or LocationVoidLink copies AMD driver module metadata and uses the amd_mem_encrypt name to disguise its kernel module.T1095 · Non-Application Layer ProtocolThe rootkit receives covert commands in specially crafted ICMP Echo Requests intercepted by Netfilter hooks.T1497.003 · Time Based ChecksThe v5 module delays installing hooks for three seconds to evade checks triggered immediately by module loading.T1547.006 · Kernel Modules and ExtensionsThe reported boot-time loader loads the VoidLink kernel module and initializes its concealment settings.T1622 · Debugger EvasionA kernel timer scans for debugging and forensic processes; the CentOS 7 variant can pause hiding or self-destruct when they are detected.