New Linux malware framework targets cloud and containers

"Researchers have uncovered a previously unknown Linux framework that can infect systems. It uses an extensive modular design with unusually advanced attack capabilities. Check Point Research discovered the framework. The developers call it VoidLink. Observers describe it as significantly more advanced than most existing Linux malware. The discovery points to a broader shift in which professional threat actors increasingly view Linux as a primary target rather than a niche platform."

"VoidLink was found in late 2025 in multiple Linux binaries available via VirusTotal. Notably, there are no indications that the framework has already been actively used in attacks in the wild. The samples found contain development artifacts such as debug symbols. This indicates that it is a framework in active development. Despite the lack of actual infections, the whole thing looks mature and well-thought-out. This suggests that attackers are preparing VoidLink for future operational use."

"The framework is written in Zig and designed with modern cloud infrastructures in mind. Once VoidLink is active, it automatically analyzes whether it is running in public cloud environments such as AWS, Azure, or Google Cloud, and whether it is running in a Docker container or a Kubernetes pod. By using cloud metadata via the APIs of relevant providers, VoidLink can precisely tailor its malware behavior to the environment in which it runs."

Check Point Research discovered a previously unknown Linux framework named VoidLink. Samples were found in late 2025 in multiple Linux binaries on VirusTotal and contained development artifacts like debug symbols, indicating active development and lack of observed in-the-wild use. VoidLink is written in Zig and targets cloud infrastructures, detecting AWS, Azure, Google Cloud, Docker containers, and Kubernetes pods via provider metadata APIs to tailor behavior. The framework uses a compact core with runtime-loadable plugins enabling system exploration, credential harvesting, lateral movement, and persistence. The maturity and modularity suggest professional actors are preparing Linux-focused tooling for future operations.

Read at Techzine Global