VoidLink Malware Puts Cloud Systems on High Alert With Custom Built Attacks

VoidLink is a sophisticated, cloud-focused malware framework that dynamically compiles custom kernel rootkits on the attacker C2 (Serverside Rootkit Compilation) tailored to each victim's kernel, enabling stable eBPF/LKM payloads; it is written in Zig, executes filelessly in memory via memfd_create/execveat, uses covert ICMP communication, probes and evades multiple security products, and includes container/Kubernetes escape capabilities—researchers note it was found in an in-progress build with debug symbols, offering detection opportunities by monitoring abnormal memory activity or unauthorized kernel module loading.