eBPF

LinkPro rootkit exploits Linux eBPF for stealthy attacks

2025년 10월 18일 Lisa Kern

A new rootkit called LinkPro has been targeting GNU/Linux systems, using eBPF technology to hide malicious activities and evade detection. Discovered in a compromised AWS infrastructure, it spreads via vulnerable Jenkins servers and malicious Docker images. The malware provides attackers with remote access while masquerading as legitimate system components.