VoidLink Linux Malware Framework Targets Cloud Environments

VoidLink is a newly identified Linux malware framework with a highly modular design built for long-term access to cloud and container environments, according to Check Point. The cloud-first implant targets major platforms such as AWS, GCP, Azure, Alibaba, and Tencent, as well as Kubernetes pods and Docker containers, and adjusts its behaviour accordingly.

It can steal credentials for cloud services and source code version control systems, with Check Point suggesting it is likely targeted at software engineers for espionage or supply-chain attacks. The framework includes rootkit-style capabilities (LD_PRELOAD, LKM and eBPF), an in-memory plugin system, and adaptive stealth that evades security products by detecting the environment, with a development API inspired by Cobalt Strike.

It is deployed via a two-stage loader that inventories security tools to calculate a risk score and evasion strategy, and it supports multiple C2 channels such as HTTP/HTTPS, ICMP and DNS tunneling, plus P2P communication between infected hosts. according to Check Point.