Tool
icmp_ctl.py
- First Reported
- Mar 25, 2026
- Latest Reported
- Mar 25, 2026
Reported Context (1)
- protocol with XOR-encrypted payloads, runtime key/magic rotation, and operator tooling (icmp_ctl.py) for commands including hide_pid, hide_port, give_root, and destruct. Elastic Analyzes VoidLink’s Hybrid Linux Rootkit and Evasion Techniques
Malware (1)
MITRE ATT&CK (7)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.