AnalysisPublished 13 Sep 2026

New tool voidsyscall : Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.

Source Reddit Cybersecurity

Discussion

voidsyscall is a cross-platform implant and command-and-control (C2) framework that operates by issuing direct syscalls on Windows and raw syscalls on Linux, bypassing the Windows API layer entirely. It uses multiple stealthy injection techniques and evasion methods to avoid detection by endpoint detection and response (EDR) tools, including runtime resolution of syscall numbers, unhooking ntdll, and polymorphic code injection. The implant supports encrypted C2 communication over HTTPS, DNS, and ICMP channels using AES-256-GCM encryption. It includes advanced anti-analysis features such as VM, sandbox, and debugger detection, and performs token manipulation and memory encryption to hinder forensic analysis. No official patch or remediation is indicated, and this tool is presented as an offensive implant framework rather than a vulnerability.

r/cybersecurity (opens in a new tab)u/Living-Map-1550 points0 comments

VoidSecSoftwares/voidsyscall: Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.

Impact

The implant enables attackers to execute code stealthily on compromised systems across multiple platforms, evade detection by common security tools, escalate privileges, persist via registry modifications, and communicate securely with C2 servers. Its advanced evasion techniques and direct syscall usage make detection and forensic analysis challenging. There is no indication of active exploitation in the wild or a vulnerability being exploited; rather, this is an offensive tool that could be used by threat actors for post-exploitation activities.

Defensive guidance

Defenders should rely on behavioral detection, network monitoring for anomalous encrypted C2 traffic over HTTPS, DNS, or ICMP, and endpoint protections that can detect direct syscall usage or unusual injection techniques. Awareness of this tool's capabilities can inform threat hunting and incident response efforts.

Summary

voidsyscall is a sophisticated implant framework that bypasses the Windows API by issuing direct syscalls resolved at runtime from ntdll, avoiding usermode hooks and EDR detection. It supports Windows, Linux, and macOS platforms and uses multiple stealthy injection methods including section mapping, process hollowing, APC queuing, and module stomping. The implant performs extensive anti-analysis checks including VM, sandbox, and debugger detection, and patches AMSI, ETW, and other instrumentation callbacks to evade detection. Communication with C2 servers is encrypted with AES-256-GCM over HTTPS, DNS, and ICMP channels. The implant also includes capabilities for token privilege escalation, memory region hiding, secure file I/O, and registry persistence using only syscalls. It is not a syscall wrapper library but a full implant framework designed for stealth and evasion.

References

Community reviews

Loading reviews…

Discussion

AI analysisMachine-generated, updated 13 Sep 2026, 14:46 UTC

Technical details

References

Community reviews

Related threats