eBPF rootkits can make local inspection lie. If malware can edit the data before tools like ss, bpftool, or ptrace display it, then live-response on the host is no longer a reliable view of kernel and socket state.
Datadog Security Labs analyzes VoidLink, LinkPro, and Atomic Arch and shows how they abuse legitimate eBPF helpers, including bpf_probe_write_user, to hide active connections and other state from familiar introspection tools. The report also lays out load-time detection methods that look at helper use before the rootkit can interfere with what defenders see.
The practical shift is trust. Post-compromise enumeration on Linux can miss active activity even from the local machine, so defenders have to treat host-side telemetry and introspection as something that can be manipulated from inside the kernel path itself.