LinkPro: An eBPF-Based Rootkit Hiding Malicious Activity on GNU/Linux

Security researchers from Synacktiv CSIRT have disclosed LinkPro, an eBPF-based Linux rootkit designed to hide malicious activity while enabling persistent backdoor access. The infection chain began with a vulnerable Jenkins server exposed to the internet, exploited through CVE-2024-23897, after which a malicious Docker image named “kvlnt/vv” was deployed across multiple Amazon EKS clusters.

The container carried a Kali Linux base image with a bash startup script, a VPN server program called “vnt” for proxy capabilities, and a Rust-based downloader malware dubbed “vGet”; the dropper embedded a vShell backdoor (v4.9.3) executed in memory and communicating via DNS tunneling. LinkPro uses two eBPF modules—“Hide” and “Knock”—to conceal its components and activate a backdoor, including hiding certain files and processes and implementing port redirection to its internal port 2233.

It masquerades as the systemd-resolved service to gain persistence, and can operate in reverse or forward modes, with the latter supporting HTTP, WebSocket, UDP, TCP, and DNS tunneling to command and control an IP address 18.199.101[.]111 over port 2233.