Malware · 50 days ago
eBPF rootkits can make local inspection lie. If malware can edit the data before tools like ss, bpftool, or ptrace display it, then live-response on the host is no longer a reliable view of kernel and socket state.
Datadog Security Labs analyzes VoidLink, LinkPro, and Atomic Arch and shows how they abuse legitimate eBPF helpers, including bpf_probe_write_user, to hide active connections and other state from familiar introspection tools. The report also lays out load-time detection methods that look at helper use before the rootkit can interfere with what defenders see.
The practical shift is trust. Post-compromise enumeration on Linux can miss active activity even from the local machine, so defenders have to treat host-side telemetry and introspection as something that can be manipulated from inside the kernel path itself.
1 source covering this story
Detection primitives for eBPF rootkits | Datadog Security Labs
We analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act.
Part of the PlainSec briefing for 2026-07-27