AN investigation into an AWS-hosted infrastructure compromise has uncovered a new GNU/Linux rootkit named LinkPro, according to findings from Synacktiv. The backdoor relies on two eBPF modules: one to conceal itself and another to be remotely activated when a magic TCP packet is received. The infection used an exposed Jenkins server vulnerable to CVE-2024–23897 as the starting point, after which a malicious Docker Hub image named "kvlnt/vv" (now removed) was deployed across several Kubernetes clusters.
The Docker image includes a Kali Linux base plus an app folder containing start[.]sh to launch SSH, a tool called vnt for proxying, and a Rust-based downloader named vGet that fetches an encrypted VShell payload from an S3 bucket to contact its C2 server over WebSocket. LinkPro also delivered to Kubernetes nodes a second malware strain and a Golang-based rootkit; it can operate in passive or active mode and only listens for C2 commands after receiving a specific TCP packet, or can initiate contact directly.
The overall operation installs the Hide eBPF module to conceal processes and network activity, uses /etc/ld.so[.]preload to load libld[.]so if needed, and employs a Knock eBPF module so reverse mode C2 communication is triggered by the magic packet, which is defined as a TCP packet with a window size of 54321.