New VoidLink malware framework targets Linux cloud servers

**VoidLink — cloud-native Linux malware framework**: Check Point researchers describe VoidLink, a sophisticated, actively developed modular Linux malware framework targeting cloud and container environments; it includes plugins for reconnaissance, credential harvesting, lateral movement, persistence and anti-forensics, uses rootkits (LD_PRELOAD, LKMs, eBPF) to hide activity, and adapts behavior when running in Docker/Kubernetes or enumerating cloud metadata. The report includes technical details and IoCs but notes no confirmed active infections, suggesting the framework may be a commercial product or targeted toolkit.