VoidLink: Detecting Advanced Cloud-Native Linux Malware

Hunting Controls & Observations

Organizations can detect VoidLink through multiple telemetry sources:

• Endpoint Controls: EDR/XDR platforms with kernel-level visibility, Linux auditd logs, LD_PRELOAD monitoring, eBPF program tracking, LKM integrity monitoring, process memory scanning
• Network Controls: Firewall logs, DNS query logs, SSL/TLS inspection for obfuscated C2 communications, ICMP traffic analysis, NetFlow data for peer-to-peer mesh networking patterns
• Identity & Access Controls: SSH authentication logs, failed authentication monitoring, keyring access auditing, shadow file access logs, Git credential harvesting detection
• Cloud & SaaS Controls: AWS CloudTrail, GCP Cloud Audit Logs, Azure Activity Log, cloud metadata service access logs (169.254.169.254), Kubernetes API audit logs, Docker runtime security monitoring

Behavioral Indicators of Attack

• Direct Syscall Patterns Bypassing libc (Endpoint): VoidLink executes system calls directly without using standard C library functions, a technique used to bypass userland security hooks installed by EDR products. This behavior appears as syscall instructions in memory regions not associated with libc.
• Adaptive Stealth Behavior Based on Security Posture (Endpoint): The malware enumerates installed security products, assigns risk scores, and dynamically modifies its behavior based on perceived monitoring levels. Observable as sequential queries for security software processes followed by changes in C2 communication patterns or encryption cycles.
• Cloud Metadata Service Reconnaissance (Cloud): Automated queries to cloud provider metadata APIs (169.254.169.254) targeting AWS, GCP, Azure, Alibaba, and Tencent Cloud platforms. Suspicious when originating from unexpected processes or with unusual user agents.
• Version-Specific Rootkit Deployment (Endpoint): Kernel version enumeration followed by deployment of different persistence mechanisms—LD_PRELOAD manipulation for kernels <4.0, loadable kernel modules for 4.0-5.4, or eBPF programs for ≥5.5. Observable through system calls querying kernel version immediately before persistence installation.
• Runtime Code Encryption and Decryption Cycles (Endpoint): Periodic encryption and decryption of code regions in memory to evade signature-based detection. Appears as repeated memory protection changes (mprotect syscalls) for the same memory regions combined with unusual entropy patterns.
• SSH Lateral Movement with Automated Credential Harvesting (Network/Identity): The SSH worm module harvests SSH private keys and known_hosts files, then attempts automated connections to discovered hosts. Observable as SSH connections to multiple internal hosts from a single source, combined with SSH key file access.
• Container Escape Attempt Patterns (Cloud/Endpoint): Exploitation of container runtime vulnerabilities or misconfigurations to escape to the host system. Observable through attempts to mount host filesystems, access Docker socket, or exploit kernel vulnerabilities like Dirty Pipe from within containers.
• Selective Log Tampering with Keyword Filtering (Endpoint): Rather than clearing entire logs, VoidLink removes specific log entries containing keywords associated with its activity. Observable as log file modifications without corresponding logrotate operations, or gaps in log sequence numbers during suspicious activity windows.

MITRE Enterprise ATT&CK Tactics and Techniques

VoidLink's methodology aligns with MITRE ATT&CK Enterprise tactics across the entire kill chain:

• Initial Access (T1195 – Supply Chain Compromise): VoidLink appears designed to target software developers and development infrastructure, potentially enabling supply chain attacks. The framework's focus on Git credential harvesting and development environment persistence suggests pre-positioning for downstream compromise.
• Execution (T1059 – Command and Scripting Interpreter): Multiple shell execution plugins enable command execution across compromised systems. The framework's plugin architecture supports dynamic command execution without writing files to disk.
• Execution (T1106 – Native API): VoidLink performs direct syscall operations to bypass userland security hooks. This technique circumvents EDR products that rely on libc function interposition.
• Persistence (T1547.006 – Boot or Logon Autostart Execution: LD_PRELOAD): The framework abuses the LD_PRELOAD environment variable to inject malicious libraries into the dynamic linking process. This technique provides persistence and enables hooking of standard library functions for stealth.
• Persistence (T1547.015 – Boot or Logon Autostart Execution: Systemd Service): VoidLink establishes persistence through systemd service creation. The malware creates legitimate-appearing service definitions that launch on system boot.
• Persistence (T1053.003 – Scheduled Task/Job: Cron): The cron_persist module installs cron jobs for periodic execution. This provides redundant persistence alongside systemd services.
• Privilege Escalation (T1611 – Escape to Host): VoidLink includes Docker escape capabilities targeting container runtime vulnerabilities. Successful container escape grants host-level access from containerized compromises.
• Privilege Escalation (T1068 – Exploitation for Privilege Escalation): The framework includes exploit modules such as Dirty Pipe for kernel exploitation. These exploits enable escalation from unprivileged to root access.
• Defense Evasion (T1014 – Rootkit): VoidLink deploys kernel-version-specific rootkits (LD_PRELOAD, LKM, eBPF) to hide processes, files, and network connections. The adaptive rootkit selection based on kernel version demonstrates sophisticated evasion planning.
• Defense Evasion (T1027 – Obfuscated Files or Information): The framework employs runtime code encryption with periodic re-encryption cycles. This self-modifying code technique evades signature-based detection and memory scanning.
• Defense Evasion (T1140 – Deobfuscation/Decode Files or Information): VoidLink decrypts code segments on-demand for execution, then re-encrypts them. This minimizes the window of clear-text malicious code in memory.
• Defense Evasion (T1070.001 – Indicator Removal: Clear Command History): The history_wipe module removes command history files to hinder forensic investigation. This anti-forensic capability complements the selective log tampering functionality.
• Defense Evasion (T1070.004 – Indicator Removal: File Deletion): The log_wiper module performs keyword-based log entry removal and file timestomping. This selective approach is stealthier than mass log deletion.
• Defense Evasion (T1480 – Execution Guardrails): VoidLink enumerates security products, assigns risk scores, and modifies behavior based on defensive posture. This environment-aware evasion represents sophisticated operational security.
• Credential Access (T1555 – Credentials from Password Stores): Multiple modules target credential stores including browser credential databases, system keyrings, and password managers. This comprehensive credential harvesting enables lateral movement and persistence.
• Credential Access (T1003.008 – OS Credential Dumping: /etc/passwd and /etc/shadow): The passwd_dump module extracts password hashes from Linux authentication files. Combined with offline cracking, this enables authentication to other systems.
• Credential Access (T1552.004 – Unsecured Credentials: Private Keys): The ssh_harvester module specifically targets SSH private keys and Git credentials. Harvested keys enable authenticated lateral movement without triggering authentication failures.
• Discovery (T1526 – Cloud Service Discovery): VoidLink includes specialized reconnaissance for AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud. The framework queries cloud metadata services to identify the hosting environment and available resources.
• Discovery (T1613 – Container and Resource Discovery): Dedicated modules enumerate Kubernetes clusters and Docker containers. This reconnaissance enables targeted container escape and lateral movement within orchestrated environments.
• Discovery (T1082 – System Information Discovery): The sys_info module collects comprehensive system information including kernel version, installed packages, and running services. This reconnaissance informs adaptive evasion technique selection.
• Lateral Movement (T1570 – Lateral Tool Transfer): The SSH worm functionality automatically propagates to systems in harvested known_hosts files. This autonomous lateral movement can rapidly expand the compromise footprint.
• Lateral Movement (T1021.004 – Remote Services: SSH): VoidLink uses harvested SSH credentials and keys to authenticate to additional systems. The framework establishes SSH tunnels for network pivoting and C2 communications.
• Collection (T1557 – Adversary-in-the-Middle): Browser credential harvesting capabilities enable man-in-the-browser attacks. This technique captures credentials even from systems with full disk encryption.
• Collection (T1115 – Clipboard Data): The framework monitors clipboard contents for sensitive information like passwords, API keys, and authentication tokens. Captured clipboard data often contains credentials users copy-paste between systems.
• Command and Control (T1071 – Application Layer Protocol): VoidLink supports multiple C2 protocols (HTTP/1.1, HTTP/2, WebSocket) with traffic obfuscation resembling legitimate formats. HTTP requests are camouflaged to appear as JSON, CSS, or PNG traffic.
• Command and Control (T1095 – Non-Application Layer Protocol): The framework implements ICMP tunneling for C2 communication in environments where outbound traffic is restricted. This enables command-and-control even through restrictive firewalls.
• Exfiltration (T1041 – Exfiltration Over C2 Channel): Stolen data is exfiltrated through the established C2 channels using the same obfuscated protocols. This blends exfiltration traffic with normal C2 communications.