Malware
VoidLink
VoidLink is a cloud-native Linux malware family designed as a modular post-exploitation framework for modern cloud and containerized environments.
VoidLink is a Linux malware family.
Background
VoidLink is a cloud-native Linux malware family built as a modular post-exploitation framework aimed at today's cloud and containerized environments. Its plugin-driven design allows components to be loaded on demand, delivering reconnaissance, credential theft, privilege escalation, lateral movement, persistence, and anti-forensic functions. The framework places a strong emphasis on operational security, encrypting itself at runtime, detecting its surroundings (including the cloud provider and any container), and applying both user-mode and kernel-level rootkit methods to stay hidden.
Rather than being an adapted older tool, VoidLink was purpose-built for cloud infrastructure, reflecting a broader move in advanced malware development toward Linux cloud workloads. No large-scale infections have been confirmed so far, but its sophistication and engineering point to possible adoption by capable adversaries seeking persistent, covert footholds in cloud environments.
Source: Malpedia (Fraunhofer FKIE).