by happyPersonR
4 subcomments
- lol there’s no real technical details in this article sadly. Checkpoint has a better analysis.
https://research.checkpoint.com/2026/voidlink-the-cloud-nati...
Some kind of opensource ish malware framework the kids are running that can use eBPF …. In addition to limiting CAP_BPF or CAP_SYS_ADMIN you should also take other measures.
by 1970-01-01
2 subcomments
- It's only Linux malware if it has a GPL or other FOSS license. This is just untrustworthy code.
--Linux users, probably
- Targeting containerized environments, VoidLink seems most sensible when accompanying universal exploits like the xz backdoor. May be indicative of continuing efforts and confidence to infiltrate the base Linux ecosystem. I imagine, this framework isn't primarily used for targeted attacks and espionage, but rather as rapid staging ground for "cyber warfare" operations.
- > Similar frameworks targeting Windows servers have flourished for years. They are less common on Linux machines.
That's good for me, as I develop on a Linux laptop but I never really understood why that is the case. I know that most people are on Windows so B2C malware naturally runs on Windows. However basically all the Internet infrastructure is on Linux and B2B malware should have been targeting that since a long time.
- trash ad for linux antivirus. who uses that anyway?
- >With no indication that VoidLink is actively targeting machines, there’s no immediate action required by defenders,
Plus no mention of how these machines get "infected". My guess is the admin will need to download something and manually install it. So a root kit ?
I wish these articles would mention how these "most advance malware" gets on your system.
by worthless-trash
0 subcomment
- Most Linux malware is low quality garbage with easily exploitable bugs in itself.
by lifetimerubyist
0 subcomment
- and here I am with my main PC with CPU mitigations off and SE Linux completely removed
come at me bro
Hacker News