Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework

VoidLink is a cloud-first Linux malware framework designed to maintain long-term access to cloud and container environments, written in Zig and capable of running in Kubernetes or Docker, with the ability to recognise multiple cloud providers including AWS, GCP, Azure, Alibaba, and Tencent. According to Check Point Research, it uses a two-stage loader and a highly modular Plugin API, with more than 30 plug-in modules by default and a web-based dashboard to manage implants, plugins, and tasks.

The framework employs adaptive stealth, runtime code encryption, self-deletion on tampering, and a range of rootkit capabilities (including LD_PRELOAD, eBPF, and LKM) to hide activity and tailor evasion to the security products detected. It supports multiple C2 channels such as HTTP/HTTPS, ICMP, and DNS, and can even form a mesh-style network between compromised hosts, all within a system designed for stealthy, long-term data collection and surveillance.

While evidence of real-world infections was not observed at the time of reporting, the research notes the potential for commercial use and emphasises securing Linux, cloud, and container environments against such threats. VoidLink was disclosed on 13 January 2026.