https://aegrah.github.io/tags/rootkit.htmlRecent content in Rootkit on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudThu, 26 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.htmlThu, 26 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.html At Elastic Security Labs, Remco Sprooten and I analyzed a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink—a cloud-native Linux malware framework first documented by Check Point Research. The dump revealed a multigenerational rootkit framework actively developed and tested across real targets, spanning CentOS 7 through Ubuntu 22.04. VoidLink's architecture immediately stood out: rather than relying on a single technique, it combines a traditional Loadable Kernel Module with eBPF programs in a hybrid design rarely encountered in the wild.https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.htmlThu, 05 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.html In the first part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I explore the theory behind how rootkits work: their taxonomy, evolution, and the hooking techniques they use to subvert the kernel. We trace the progression from early userland shared object rootkits through LKM-based implants, eBPF rootkits, and emerging io_uring-based evasion. The publication covers rootkit loader and payload components, kernel hooking techniques including IDT hooking, syscall table patching, inline hooking, VFS hooking, ftrace and kprobes abuse, the KHOOK framework, userspace LD_PRELOAD interposition, and eBPF program attachment.