Linux eBPF rootkits such as VoidLink, LinkPro, and the Atomic Arch campaign use rare helpers to hide sockets, obscure their own programs, and kill ptrace-based debuggers before the kernel finishes processing them. The article shows that defenders should focus on load-time fingerprinting of eBPF programs because helpers like bpf_probe_write_user(), bpf_override_return(), and bpf_send_signal() reveal malicious intent before the rootkit can conceal itself. #VoidLink #LinkPro #AtomicArch #bpf_probe_write_user #bpf_override_return #bpf_send_signal
Keypoints
- Linux malware authors are increasingly using eBPF rootkits to evade both traditional and modern defenses.
- VoidLink hides active TCP connections from ss by using bpf_probe_write_user() to tamper with Netlink response buffers in memory.
- LinkPro hides its own eBPF programs from bpftool and libbpf enumeration by using bpf_override_return() to inject -ENOENT into BPF_PROG_GET_NEXT_ID, BPF_MAP_GET_NEXT_ID, and BPF_LINK_GET_NEXT_ID flows.
- The Atomic Arch campaign uses a ptrace tracepoint program to detect PTRACE_ATTACH and PTRACE_SEIZE attempts against protected PIDs and kills the caller with SIGKILL via bpf_send_signal().
- The article emphasizes that the most reliable detection point is BPF_PROG_LOAD, before a program can attach and interfere with inspection.
- Datadog Agent Workload Protection captures eBPF helper IDs at load time, enabling rules based on rare helpers such as BPF_PROBE_WRITE_USER, BPF_OVERRIDE_RETURN, and BPF_SEND_SIGNAL.
- Correlating multiple suspicious helper uses within a short window can produce a high-confidence indicator of an eBPF rootkit installation.
MITRE Techniques
- [T1055 ] Process Injection – VoidLink tampers with user-space memory from an eBPF program to alter what ss reads, described as “turning a debug helper into a precise memory editor” and “inflates the length field … so the parser’s cursor jumps straight over it.”
- [T1014 ] Rootkit – The article describes multiple Linux eBPF rootkits using kernel-level helpers to hide connections, hide eBPF objects, and interfere with tracing, including LinkPro, VoidLink, and Atomic Arch.
- [T1562.001 ] Disable or Impair Defenses: Disable or Impair Tooling – VoidLink and LinkPro impair visibility by hiding sockets from ss and hiding eBPF programs from bpftool/libbpf enumeration, making defensive tooling report incomplete results.
- [T1620 ] Reflective Code Loading – The article notes that eBPF programs are loaded as inert instruction blobs through BPF_PROG_LOAD and later rewritten by the verifier into callable kernel code, enabling malicious logic to be staged and activated inside the kernel.
- [T1205 ] Traffic Signaling – The Atomic Arch ptrace hook kills the calling process with SIGKILL when a debugger tries to attach to a protected PID, effectively signaling and blocking monitoring activity (‘kill the calling process’).
- [T1562.006 ] Impair Defenses: Indicator Blocking – VoidLink blocks visibility of hidden network connections, LinkPro blocks enumeration of its eBPF components, and the ptrace handler blocks analysis tools by killing them before attachment completes.
Indicators of Compromise
- [Helper names ] suspicious eBPF capability usage observed at load time – bpf_probe_write_user, bpf_override_return, and bpf_send_signal
- [BPF commands ] enumeration and load activity tied to malicious behavior – BPF_PROG_LOAD, BPF_PROG_GET_NEXT_ID, BPF_MAP_GET_NEXT_ID, and BPF_LINK_GET_NEXT_ID
- [Linux trace/debug paths ] visible user-space trace output from LinkPro – /sys/kernel/debug/tracing/trace_pipe, trace_pipe
- [Map names ] internal rootkit state used for hiding targets – hidden_pids, main_ebpf_progs
- [System call / tracepoint names ] attachment and enumeration hooks used by the rootkits – __sys_recvmsg, __x64_sys_bpf, tp/syscalls/sys_enter_ptrace, sys_enter_bpf
- [Process/tool names ] affected visibility and analysis tools – ss, bpftool, libbpf, gdb, and strace
Read more: https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/