New Chinese-Made Malware Framework Targets Linux-Based Cloud Environments

Check Point Research discovered VoidLink, a sophisticated, modular Linux malware C2 framework written in Zig and actively developed by Chinese-speaking authors; it includes custom loaders, implants, rootkits and ~37 plugins enabling reconnaissance, persistence, container escapes, secret extraction, lateral movement and cloud-provider detection across AWS, GCP, Azure, Alibaba and Tencent. Documentation and artifacts indicate active development and commercial intent, but researchers have not observed confirmed real-world infections; defenders are advised to harden Linux, cloud and container environments.