A newly uncovered Linux rootkit, dubbed LinkPro, leverages extended Berkeley Packet Filter (eBPF) technology to conceal its presence and maintain persistence on compromised systems.
The Synacktiv CSIRT discovered the malware during an investigation of a breached AWS infrastructure. LinkPro operated as a stealthy backdoor across Elastic Kubernetes Service (EKS) clusters following the exploitation of a public-facing Jenkins server (CVE-2024-238976).
Sophisticated eBPF-Based Concealment
Developed in Go, LinkPro uses dual eBPF modules to manage both concealment and command activation.
The “Hide” module deploys tracepoint and kretprobe hooks to intercept kernel-level calls like getdents and sys_bpf, filtering directory listings and hiding its BPF objects from tools such as bpftool.
This effectively suppresses visibility of malicious process IDs, directories (.tmpdata, .system), and loaded programs.
When eBPF loading fails due to kernel constraints, the malware falls back to a user-space concealment method via an injected libld.so library, configured through /etc/ld.so.preload to hook libc functions.
By altering outputs of standard utilities such as netstat and ls, libld.so ensures the rootkit’s traces including its listening port (2233) remain hidden from conventional system inspection tools.
Complementing concealment is the “Knock” module, which implements XDP and TC eBPF programs. These intercept network packets before they reach the Linux stack, allowing activation through a “magic packet” mechanism.
A TCP SYN packet with a specific window size (54321) signals the rootkit to open command channels, evading firewalls and traditional network logging.
Persistent and Modular Design
Persistence is achieved by impersonating systemd’s legitimate name resolution service (systemd-resolved). LinkPro places its executable at /usr/lib/.system/.tmpdata.resolveld and installs a matching systemd unit under /etc/systemd/system/systemd-resolveld.service.
The malware then timestamps modification dates to mimic legitimate files and ensures automatic execution at system startup.
Each LinkPro sample bundles multiple ELF modules a shared object for LD_PRELOAD hijacking, two eBPF binaries, and an unused kernel object enabling flexibility in deployment.
Depending on configuration, the rootkit can operate in passive mode, listening for commands, or in active mode, initiating HTTP- or DNS-tunneled communication with its command server at 18.199.101.111.
Upon activation, LinkPro provides comprehensive capabilities: executing shell commands, managing files, deploying additional payloads, and establishing SOCKS5 proxy tunnels for lateral movement across compromised environments.
Synacktiv’s analysis underscores LinkPro’s technical sophistication, a modular, multi-layered approach to persistence and evasion that marks a new stage in Linux malware evolution, exploiting eBPF for kernel-level stealth.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
%20technology.){kind=link}