VoidLink threat dossier

analyst@voidlink:~/dossier$ cat 01_overview.md

01Executive Summary

A cloud-native Linux malware framework, now confirmed in the wild

--- v1.0  2026-01-31
+++ v2.0  2026-09-25
- No confirmed real-world infections as of January 2026
+ In the wild: victims in tech & finance, Sep 2025 → Jan 2026   (Cisco Talos)
+ Operator named UAT-9921; Check Point disputes the timeline     (Talos / THN)
+ Leaked rootkit source: 4 kernel-rootkit generations           (Elastic)
+ Windows build of the core implant indicated; RBAC in the C2    (Talos)
+ New IoCs: 2 C2 IPs, rootkit sample, 7 host artifacts           (Elastic / Ontinue)
+ Vendor detections: Snort, ClamAV, YARA, Splunk                 (various)
~ Rewrote Falco + auditd rules (old eBPF rule matched the wrong syscall)
~ All 7 Check Point implant hashes listed (v1.0 page showed 3)

Key characteristics

analyst@voidlink:~/dossier$ tail -n 50 02_timeline.log

02Timeline

From first victims to public research, Sep 2025 → Sep 2026

1. 2025-09
   Earliest VoidLink-related victims, according to Talos, which believes this was still version 1.0. Check Point says it has seen no evidence of use this early.

   Cisco Talos
2. 2025-11
   Development of the documented build starts (late November), per the developer's own planning files.

   Check Point Research
3. 2025-12
   Working implant with 88K+ lines of code within a week (4 Dec test build). Check Point then finds a cluster of unfamiliar Linux samples that still contain debug symbols.

   Check Point Research
4. 2026-01-13
   Public disclosure: "VoidLink: The Cloud-Native Malware Framework".

   Check Point Research
5. 2026-01-15
   Elastic ships YARA rules Linux_Trojan_VoidLink_*.

   Elastic protections-artifacts
6. 2026-01
   Sysdig describes server-side rootkit compilation: the C2 builds kernel modules for each victim's kernel.

   Sysdig TRT
7. 2026-01-20
   Reports that the framework was written almost entirely by an AI agent.

   Check Point Research · The Register
8. 2026-01-22
   Splunk publishes the "VoidLink Cloud-Native Linux Malware" analytic story.

   Splunk Threat Research
9. 2026-02-09
   Implant teardown: "not a proof of concept". Hard-coded C2 8.149.128[.]10.

   Ontinue
10. 2026-02-10
    Talos names UAT-9921 and reports victims in technology and finance, a Windows build, and role-based access control in the C2.

    Cisco Talos
11. 2026-02-13
    Check Point "cannot independently verify" the September 2025 start date or the actor's activity since 2019.

    The Hacker News
12. 2026-03-13
    Elastic YARA rule Linux_Rootkit_VoidLink_243306b5.

    Elastic protections-artifacts
13. 2026-03-26
    "Illuminating VoidLink": analysis of leaked rootkit source, binaries and deployment scripts. Evidence of operational use.

    Elastic Security Labs
14. 2026-04→09
    No new primary research found. No government advisory. No MITRE ATT&CK software entry.

    Checked 2026-09-25

analyst@voidlink:~/dossier$ cat 03_architecture.md

03Technical Architecture

Multi-stage loader with fileless execution

stage0 ─► fork() ─► prctl rename "[kworker/0:0]" ─► memfd_create()
       ─► HTTP GET stage1 ─► execveat(memfd)   # payload never touches disk

analyst@voidlink:~/dossier$ cat 04_cloud.md

04Cloud & Container Awareness

Fingerprints the provider and runtime, then changes behaviour to suit

Runtime detection

Container-specific capabilities

analyst@voidlink:~/dossier$ cat 05_rootkits.md

05Rootkit Mechanisms

Picks a rootkit to match the kernel; four generations recovered from leaked source

analyst@voidlink:~/dossier$ cat 06_c2.md

06Command & Control

Several transports, with traffic dressed up as ordinary web content

analyst@voidlink:~/dossier$ ls ./plugins | wc -l # 35–37

07Plugin Ecosystem

35–37 modules; direct syscalls get around libc hooks

analyst@voidlink:~/dossier$ cat 08_evasion.md

08Evasion & Anti-Analysis

Scores how risky the environment is, then sets its operating tempo

analyst@voidlink:~/dossier$ cat 09_ai_dev.md

09AI-Generated Development

One developer, an AI coding agent, and a spec-first workflow

analyst@voidlink:~/dossier$ cat 10_in_the_wild.md

10In the Wild & Attribution

UAT-9921, the victims, and a disputed timeline

analyst@voidlink:~/dossier$ cat 11_iocs.txt

11Indicators of Compromise

Hashes cross-checked against the vendors' published lists (Sep 2026)

# Stage 0 loader (Check Point)
70aa5b3516d331e9d1876f3b8994fc8c18e2b1b9f15096e6c790de8cdadb3fc9

# Stage 1 loader (Check Point)
13025f83ee515b299632d267f94b37c71115b22447a0425ac7baed4bf60b95cd

# Core implants (Check Point)
05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69
15cb93d38b0a4bd931434a501d8308739326ce482da5158eb657b0af0fa7ba49
6850788b9c76042e0e29a318f65fceb574083ed3ec39a34bc64a1292f4586b41
6dcfe9f66d3aef1efd7007c588a59f69e5cd61b7a8eca1fb89a84b8ccef13a2b
28c4a4df27f7ce8ced69476cc7923cf56625928a7b4530bc7b484eec67fe3943
e990a39e479e0750d2320735444b6c86cc26822d86a40d37d6e163d0fe058896
4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

# Kernel rootkit (Elastic YARA Linux_Rootkit_VoidLink_243306b5 reference sample)
8bce8daacaaa546a8fc77f484d776560a28dfb024e3b7aa7c6b322c7c5716ac5

# Alibaba Cloud: named in operator scripts (Elastic); first is Ontinue's hard-coded C2
8.149.128[.]10
116.62.172[.]147

analyst@voidlink:~/dossier$ cat 12_detection.yml

12Detection & Hunting

Vendor content, plus starter rules to tune for your environment

- list: voidlink_allowed_bpf_procs
  items: [falco, tetragon, cilium-agent, bpftool, systemd]

- rule: VoidLink - Fileless execution from memfd
  desc: Process executed from an anonymous memfd (Stage 1 memfd_create + execveat)
  condition: spawned_process and proc.is_exe_from_memfd = true
  output: >
    Fileless exec from memfd (proc=%proc.name exe=%proc.exe parent=%proc.pname
    cmdline=%proc.cmdline container=%container.id)
  priority: CRITICAL
  tags: [voidlink, T1620]

- rule: VoidLink - Unexpected bpf() caller
  desc: bpf syscall from a process outside the allowlist (eBPF rootkit load)
  condition: evt.type = bpf and evt.dir = > and not proc.name in (voidlink_allowed_bpf_procs)
  output: "bpf() by unexpected process (proc=%proc.name exe=%proc.exe user=%user.name)"
  priority: WARNING
  tags: [voidlink, T1014]

- rule: VoidLink - Kernel module load
  desc: init_module / finit_module outside of expected tooling
  condition: evt.type in (init_module, finit_module) and not proc.name in (modprobe, insmod, systemd-modules-load)
  output: "Kernel module load (proc=%proc.name exe=%proc.exe cmdline=%proc.cmdline)"
  priority: CRITICAL
  tags: [voidlink, T1547.006]

- rule: VoidLink - ld.so.preload modified
  desc: Write to /etc/ld.so.preload (LD_PRELOAD rootkit persistence)
  condition: open_write and fd.name = /etc/ld.so.preload
  output: "ld.so.preload written (proc=%proc.name exe=%proc.exe user=%user.name)"
  priority: CRITICAL
  tags: [voidlink, T1574.006]

# Kernel module loads (LKM rootkit)
-a always,exit -F arch=b64 -S init_module,finit_module -k voidlink_lkm

# eBPF program / map activity (eBPF rootkit); noisy on Cilium/Falco hosts
-a always,exit -F arch=b64 -S bpf -k voidlink_bpf

# Fileless loader
-a always,exit -F arch=b64 -S memfd_create -k voidlink_memfd

# LD_PRELOAD rootkit persistence
-w /etc/ld.so.preload -p wa -k voidlink_preload

# 1. Fake kernel threads: real kworkers are children of kthreadd (PID 2) and have no exe
for p in /proc/[0-9]*; do
  c=$(cat "$p/comm" 2>/dev/null) || continue
  case "$c" in kworker*) ;; *) continue ;; esac
  pp=$(awk '/^PPid:/{print $2}' "$p/status" 2>/dev/null)
  [ "$pp" != 2 ] && echo "SUSPECT pid=${p#/proc/} comm=$c ppid=$pp exe=$(readlink "$p/exe")"
done

# 2. Processes running from a memfd (strong signal) or a deleted file (noisy: package upgrades cause it too)
ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E 'memfd:|\(deleted\)'

# 3. VoidLink eBPF pin/map, then review every loaded BPF program by hand
ls -la /sys/fs/bpf/ 2>/dev/null | grep -i vl_
bpftool map show 2>/dev/null | grep -i vl_
bpftool prog show 2>/dev/null

# 4. Known module names (a hidden LKM will NOT appear here)
grep -E '^(vl_stealth|amd_mem_encrypt) ' /proc/modules
find / -xdev \( -name 'vl_stealth*.ko' -o -name 'amd_mem_encrypt*.ko' \) 2>/dev/null

# 5. Preload hijack
[ -s /etc/ld.so.preload ] && cat /etc/ld.so.preload

analyst@voidlink:~/dossier$ cat 13_mitigation.md

13Mitigation & Defence

Treat VoidLink as a cloud-identity and control-plane risk, not only an endpoint problem

analyst@voidlink:~/dossier$ jq . 14_attack_map.json

14MITRE ATT&CK Mapping

Analyst mapping. VoidLink has no ATT&CK Software ID as of Sep 2026

analyst@voidlink:~/dossier$ column -ts, 15_compare.csv

15Threat Comparison

How VoidLink compares with familiar tooling

analyst@voidlink:~/dossier$ cat 16_references.bib

16References

Primary research first, then news coverage