Executive Summary
VoidLink is a sophisticated, cloud-native malware framework attributed to a Chinese-speaking threat actor, notable for being developed primarily through AI-assisted workflows. The framework utilizes a rare hybrid architecture that combines traditional Loadable Kernel Modules (LKMs) with eBPF programs to achieve deep kernel-level concealment and bypass modern detection tools like 'ss' and 'netstat'.
The attack chain involves an LKM (masquerading as 'amd_mem_encrypt') that performs syscall hooking via ftrace and an eBPF component that manipulates Netlink socket responses in userspace memory to hide network connections. The malware supports a stealthy ICMP-based command-and-control (C2) channel that bypasses standard firewall rules and leaves no listening ports. Targeted environments include CentOS 7 through Ubuntu 22.04, frequently hosted on cloud infrastructure like Alibaba Cloud.
This threat is significant due to its 'Ultimate Stealth v5' features, including delayed initialization to evade EDR, anti-debugging scans for forensic tools, and the use of AI to rapidly iterate and lower the barrier for complex kernel-level development. The framework is designed to protect and hide separate fileless implants running from memory-mapped file descriptors (memfd).