Analysis of VoidLink: A Cloud-Native Malware Threat Targeting Linux Systems

Check Point Research describes VoidLink, a highly sophisticated Linux malware framework engineered for cloud-native environments. VoidLink is modular (37+ plugins), written in Zig with multiple loaders and rootkit options (LD_PRELOAD, eBPF, LKM), performs cloud and container reconnaissance (AWS, GCP, Azure, Alibaba, Tencent, Docker, Kubernetes), uses runtime code encryption and adaptive OPSEC measures, and includes a web-based operator dashboard supporting multi-protocol C2; samples show active development but no confirmed widespread infections.