Underground forums share eBPF rootkit code and tutorials
Original title: eBPF Rootkits: Why Underground Actors Are Taking Notice
A Russian-language Duty Free guide covers process hiding, magic-packet activation, and AES-256-GCM command-and-control.
Flare reports underground posts sharing eBPF rootkit source and step-by-step build guides, including a Duty Free tutorial the author illustrated with screenshots. The article also recaps earlier BPF and eBPF malware such as BPFDoor, Symbiote, and LinkPro, plus older and unverified exploit code. Detection is hard because the programs use the same bpf() interface as legitimate tools and do not load a kernel module.
Unconfirmed: The kTLS and eBPF sockmap local privilege-escalation proof of concept is unverified, and its all-kernels-since-4.18 claim is incorrect.
- The guide activates the implant with a TCP SYN packet of a specific window size.
- It hooks getdents64 and uses XDP to drop traffic from 43 antivirus-related IPs.
- Flare found 10 related Pastebin posts with XDP code and microsecond timing thresholds.
- One sample's author credited Claude in a comment for generating BPF instructions.
Impact: hidden processes, stealth, and a remotely triggered backdoor
- Threat actors
- Red Menshen
- Organizations
- Flare
- Countries
- China
From the original article
5 min read at bleepingcomputer.com
Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit source code, tutorials, and exploits targeting Linux systems. [...]
By Sponsored by Flare · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.