Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Sysdig Threat Research Team analyzed VoidLink, a sophisticated Linux malware framework targeting cloud environments. Key findings include the first documented Serverside Rootkit Compilation, Chinese development with AI assistance, adaptive detection evasion, and use of the Zig programming language. VoidLink employs a multi-stage loader architecture, fileless execution techniques, and kernel-level stealth mechanisms. It features three control channels, including a covert ICMP channel, and specialized functionality for cloud and container environments. Despite its sophistication, VoidLink can be detected using runtime monitoring tools. The malware shows indicators of Chinese-speaking developers with significant kernel expertise, likely using AI-assisted development methods.

VoidLink represents a new class of Linux malware framework that targets cloud and containerized environments with unprecedented sophistication. Its hallmark is the first documented instance of serverside compilation of kernel rootkits, allowing attackers to dynamically generate kernel modules tailored to the victim's environment, enhancing stealth and persistence. The malware is developed by Chinese-speaking actors with deep kernel expertise, likely leveraging AI-assisted development to optimize evasion and functionality. VoidLink uses a multi-stage loader architecture that enables fileless execution, reducing forensic artifacts and complicating detection. It employs kernel-level stealth mechanisms, including eBPF (extended Berkeley Packet Filter) programs, to hide its presence and activities from traditional security tools. The malware communicates via three control channels, notably including a covert ICMP channel, which is unusual and complicates network detection. Its design specifically targets cloud and container environments, exploiting their unique characteristics to maintain persistence and evade detection. Indicators of compromise include multiple MD5 and SHA1 hashes of components and an IP address linked to command-and-control infrastructure. Although no known exploits are currently active in the wild, the malware’s capabilities suggest a high potential for targeted attacks against cloud infrastructure. Detection is possible through advanced runtime monitoring tools that can identify anomalous kernel behavior and network traffic patterns. The use of the Zig programming language for kernel module development is novel, indicating a shift in malware development practices. Overall, VoidLink exemplifies a highly adaptive and stealthy threat that challenges conventional Linux security paradigms.

MD5 of 13025f83ee515b299632d267f94b37c71115b22447a0425ac7baed4bf60b95cd

MD5 of 15cb93d38b0a4bd931434a501d8308739326ce482da5158eb657b0af0fa7ba49

MD5 of 05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69

MD5 of 4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

MD5 of 70aa5b3516d331e9d1876f3b8994fc8c18e2b1b9f15096e6c790de8cdadb3fc9

SHA1 of 13025f83ee515b299632d267f94b37c71115b22447a0425ac7baed4bf60b95cd

SHA1 of 4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

SHA1 of 70aa5b3516d331e9d1876f3b8994fc8c18e2b1b9f15096e6c790de8cdadb3fc9

SHA1 of 15cb93d38b0a4bd931434a501d8308739326ce482da5158eb657b0af0fa7ba49

SHA1 of 05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69

Detailed information about VoidLink threat analysis: C2-compiled kernel rootkits discovered. Get real-time updates, technical details, and mitigation strategies

Threats Tagged 'ebpf'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ebpf'

Lead Pen Test Professional